EUVD-2026-59150

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

EUVD-2026-59142

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-72243 selinux: check connect-related permissions on TCP Fast Open

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

EUVD-2026-58897

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5siginfo kfree past RCU grace period in tcpconnect The md5+ao reconciliation in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: if needsmd5 tcpaodestroysocksk, false; else if needsao tcpclearmd5listsk;...

CVE-2026-72139 tcp: defer md5sig_info kfree past RCU grace period in tcp_connect

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5siginfo kfree past RCU grace period in tcpconnect The md5+ao reconciliation in tcpconnect net/ipv4/tcpoutput.c has two symmetric branches: if needsmd5 tcpaodestroysocksk, false; else if needsao tcpclearmd5listsk;...

CVE-2026-72020 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

CVE-2026-68477 ipvs: fix more places with wrong ipv6 transport offsets

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

EUVD-2026-59099

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

Aquatronica Controller System <= 5.1.6 - Information Disclosure

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized...

D-Link Central WifiManager - Server-Side Request Forgery

D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an...

PT-2026-72439

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf nat sip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT...

PT-2026-72690

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO BY FRAGS 0xFFFF When MTU is large, ip6 default advmss can return IPV6 MAXPLEN 65535. This is interpreted by TCP as mss clamp, allowing the MSS to reach 65535. However, 0xFFFF is...

PT-2026-72704

In the Linux kernel, the following vulnerability has been resolved: tcp: clear sock ops cb flags before force-closing a child socket A child socket inherits the listener's bpf sock ops cb flags via sk clone lock. If its setup fails in tcp v4 syn recv sock / tcp v6 syn recv sock, the child is free...

PT-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip vs seq structs in ip vs conn new Commit 9a05475cebdd "ipvs: avoid kmem cache zalloc in ip vs conn new" changed ip vs conn new to allocate an ip vs conn object with kmem cache alloc. The function then initializ...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: r...

PT-2026-72822

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet tcp alloc queue, when a connection is closed during the allocation process e.g., nvmet tcp set queue sock returns -ENOTCONN, the error handling jumps to out destroy s...

PT-2026-72821

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet tcp set queue sock The return value of nvmet tcp set queue sock is currently ignored in nvmet tcp tls handshake done. If it fails e.g., due to the socket not being in TCP ESTABLISHED state,...

PT-2026-72431

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

PT-2026-72327

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig info kfree past RCU grace period in tcp connect The md5+ao reconciliation in tcp connect net/ipv4/tcp output.c has two symmetric branches: if needs md5 tcp ao destroy socksk, false; else if needs ao tcp clear md...