UBUNTU-CVE-2026-98955

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftinner: Fix IPv6 innerthoff desync In nftinnerparsel2l3, when processing inner IPv6 packets, ipv6findhdr correctly computes the transport header offset by traversing all extension headers; however, the result is...

SUSE CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in ip,6appenddata Including the transhdrlen in the length is problematic when the packet is partially filled for example, if something like sendMSGMORE occurred earlier when appending to an...

AZL-108126 CVE-2026-98417 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

UBUNTU-CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98401

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

PT-2026-114381

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the icmp send tracepoint where the system performs invalid transport header access. The TP fast assign function calls udp hdrskb without first verifying if the packet ...

PT-2026-114380

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2.0-rc4 Description A crash occurs in the qdisc pkt len segs init function due to a stale transport header offset during tunnel decapsulation. This happens when an encapsulated packet with Generic Segmentation Offload GS...

CVE-2026-98417: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: erspan: Do not assume that the transport header is always set. Rewrite the tests for ip6erspantunnelxmit and erspanfbxmit to not assume that the transport header is set. syzbot reported: WARNING: CPU: 0 PID: 1350 at...

CVE-2026-80839

CVE-2026-80839 affects the batman-adv module in the Linux kernel . The root cause is that batadv_tvlv_call_handler() sets the 16-bit network and transport header offsets from a received multicast TVLV without validating whether the TVLV end offset is representable. When it exceeds the field's ran...

EUVD-2026-71289

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct skbuff are 16-bit offsets from skb-head, and U16MAX is reserved as the unset transport header value. batadvtvlvcallhandle...

PT-2026-85717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the batadv tvlv call handler function sets network and transport header fields from a received multicast TVLV without verifying if the TVLV...

PT-2026-86196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tap get user xdp function when processing VLAN-tagged frames. The skb set network header function is called prematurely, advancing the network header past the VLAN...

PT-2026-86197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers function, skb set network header is called to advance the...

PT-2026-91796

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport header when sending VLAN-tagged frame In tap get user xdp, when processing a VLAN-tagged frame e.g. ETH P 8021Q, skb set network header is called first to advance network header past the VLAN tag to...

PT-2026-91791

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport header when sending VLAN-tagged frame In packet parse headers, when processing a VLAN-tagged frame, skb set network header is called to advance network header past the VLAN tag to the inner protoc...