CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...

CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...

CVE-2026-18086

IBM i 7.3–7.6 is affected by CVE-2026-18086 in Java Secure Sockets Extension where improper bounds checking could allow a local attacker to execute arbitrary code or cause a denial of service. The NVD/NVD IBM bulletin describe the root cause as bounds-checking issues in JSSE, with a base CVSS v3....

CVE-2026-18068 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion...

CVE-2026-18068

CVE-2026-18068 affects IBM i versions 7.3, 7.4, 7.5, and 7.6 and relates to the Java Secure Sockets Extension (JSSE). The root cause is a byte-count and element-count confusion that could allow a remote attacker to obtain sensitive information. The vulnerability is reported with a moderate base s...

CVE-2026-17029 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17029

IBM i 7.3–7.6 are affected by CVE-2026-17029 due to an out-of-bounds write in the Java Secure Sockets Extension (JSSE). The local attacker could execute arbitrary code on the system. CVSS v3.1 base score is 8.8 (LOCAL, LOW complexity, HIGH impact across confidentiality, integrity, and availabilit...

CVE-2026-17029 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

Windows Sockets Driver Privilege Escalation

The vulnerability of the driver for the afd.sys auxiliary function in Windows Sockets operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68161

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

UBUNTU-CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68117

In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert the new socket tipcskinsert returns non-zero, its error path frees the sk with skfree but leaves sock-sk pointing at the freed object...

CVE-2026-68118

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...

CVE-2026-68404

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...

CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...