UBUNTU-CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

UBUNTU-CVE-2026-68415

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68426 xfrm: fix stale skb->prev after async crypto steals a GSO segment

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

CVE-2026-68426 xfrm: fix stale skb->prev after async crypto steals a GSO segment

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

CVE-2026-68426

CVE-2026-68426 affects the Linux kernel xfrm subsystem. A bug in async crypto handling can leave skb->prev pointing to freed memory when GSO segments are stolen, causing a use-after-free. Reported impact includes potential denial of service or, in some cases, arbitrary code execution. The fix ...

CVE-2026-68420

CVE-2026-68420 concerns the Linux kernel xfrm subsystem. The issue is a stack-out-of-bounds read triggered when an outbound IPsec policy uses optional IPTFS templates, flowing from xfrm_tmpl_resolve_one() and xfrm_state_find() via the outbound path. The fix extends previous checks that blocked op...

CVE-2026-68420 xfrm: reject optional IPTFS templates in outbound policies

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68415

The CVE-2026-68415 entry documents a Linux kernel xfrm (IPSec) flaw where xfrm_state_gc_task can dereference stale mode_cbs after a failed IPTFS state setup and subsequent module unload. The root cause is failing to clear x->mode_cbs before publishing mode_data, allowing deferred GC to access ...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fixed an issue where uninitialized saddr values were used in xfrm6getsaddr. The xfrm6getsaddr function does not check the return value of ipv6devgetsaddr. When ipv6devgetsaddr fails to find a suitable source address...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fixed the race condition in ipRtbug for icmpRouteLookup reverse path icmpRouteLookup performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM IPsec policies. T...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: xfrm: Always flush the state and policy upon the NETDEVUNREGISTER event. syzbot reports that the refcount of “struct xfrmstate” is leaking. unregisternetdevice: Waiting for netdevsim0 to become free. Usage count = 2. reftracke...

Linux Distros Unpatched Vulnerability : CVE-2026-68426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invarian...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-3126)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bridge: brndsend: linearize skb before parsing ND optionsCVE-2026-31682 media: mc, v4l2: serialize REINIT and REQBUFS with...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-3071)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bridge: brndsend: linearize skb before parsing ND optionsCVE-2026-31682 media: mc, v4l2: serialize REINIT and REQBUFS with...

CVE-2026-64579

A flaw was found in the Linux kernel's xfrm policy component. An issue in the xfrmhashrebuild function, specifically with the preallocation of inexact policy bins, can lead to memory allocation failures under memory pressure. This failure can corrupt internal data structures, allowing a local...

SUSE CVE-2026-64579

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrmhashrebuild reinsert xfrmhashrebuild's first loop preallocates the bins/chains the reinsert loop needs, so the reinsert after hlistdelrcu cannot allocate or fail. But its guard is...

SUSE CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

SUSE CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2971)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : USB: core: Limit the length of unkillable synchronous timeoutsCVE-2026-43428 usb: typec: ucsi: validate connector number in...