CVE-2026-68169 mptcp: pm: userspace: fix use-after-free in get_local_id

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

EUVD-2026-55555

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

CVE-2026-68122 ovpn: fix peer refcount leak in TCP error paths

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

EUVD-2026-55503

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68122

CVE-2026-68122: Linux kernel ovpn code has a race in TCP error paths where ovpn_peer_hold() refs can be leaked if schedule_work() is already pending. The fix is to check schedule_work() return value on both RX/TX error paths and drop the extra reference with ovpn_peer_put() when the work is alrea...

CVE-2026-68122 ovpn: fix peer refcount leak in TCP error paths

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68119

The CVE-2026-68119 issue concerns the Linux kernel TCP-AO implementation: when constructing standalone TCP responses with TCP-AO options, the TCP header padding is not fully initialized if the MAC length is not four-byte aligned. The function tcp_ao_hash_hdr() writes only the MAC, leaving 1–3 pad...

EUVD-2026-55500

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

EUVD-2026-55499

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...

CVE-2026-68118 tcp: challenge ACK for non-exact RST in SYN-RECEIVED

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported a MPTCP deadlock at the time of fallback: WARNING: possible recursive locking detected 6.18.0-rc7-virtme 1 Not tainted -------------------------------------------...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect After the committed code below, if the MPC subflow is already in the TCPCLOSE status or has fallen back to TCP at the mptcpdisconnect time, mptcpdofastclose skips setting the sendfastclos...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Fixed the detection of protocol fallback using BPF. The sockmap feature allows for BPF syscall from user space, or based on BPF sockops, replacing the skprot of sockets during protocol stack processing with sockmap’s...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: fixed a race condition in mptcppmnlflushaddrsdoit Eulgyu Kim reported crashes in mptcppmnlgetlocalid and/or mptcppmnlisbackup The root cause is the listspliceinit function in mptcppmnlflushaddrsdoit, which is not ready...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed the range of cmd-req.sg when the PDU length or offset exceeds sgcnt, and then use bogus values for sg-length/offset...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: Use dstdevnetrcu instead. Replace the three dstdev calls with a helper function enabled for lockdep...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Server: Fixed a leak of activenumconn in ksmbdtcpnewconnection. When ksmbdtcpnewconnection fails due to a kthreadrun failure, the transport is freed using freetransport, which does not decrement activenumconn, resulting in a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialize rcvmss before calling tcpsendactivereset in mptcpdofastclose. syzbot reported a divide-by-zero issue in tcpselectWindow for MPTCP sockets. 0 We had a similar issue with bare TCP and fixed it in commit 499350a5a6...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: fixed a race condition in mptcppmdeladdtimer The mptcppmdeladdtimer function can call skstoptimersyncsk, &entry-addtimer. It is reported that there might already be a free entry, as reported by syzbot. Added RCU...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Fallback earlier on simultaneous connections Syzkaller reports a race condition in simultaneous connections that leads to inconsistent fallback behavior. WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515...