PT-2026-79700

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf flow table: drop existing skb dst before skb dst set noref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dst entry assigned during earlier RX ...

UBUNTU-CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

PT-2026-72261

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec del rxsc ctx freed the per-SC metadata dst with metadata dst free, which kfrees the object unconditionally an...

PT-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst entry is provided to check the skb headroom and to set the iph-frag off field...

PT-2026-72592

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup bearer due to premature dst cache destroy TIPC UDP media bearer teardown calls dst cache destroy on its replicast caches before calling synchronize net to wait for concurrent RCU readers transmitters to...

PT-2026-72441

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: validate skb dst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relie...

PT-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use correct direction to set up tunnel route The layer 2 encapsulation and layer 3 tunnel information in the xmit path is taken from the other tuple, because the tunnel information that is included in the...

Security Bulletin: IBM i is Affected By A Denial of Service Vulnerability DST/SST [CVE-2026-16887]

Summary IBM i is vulnerable to a denial of service due to an out-of-bounds write CVE-2026-16887 in Dedicated System Tools DST / System Service Tools SST as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16887 DESCRIPTION: IBM i could allow a remote attacker t...

CVE-2026-68377

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68377

CVE-2026-68377 affects the Linux kernel net/sched component, specifically act_tunnel_key. The issue is a race leading to use-after-free during tunnel_key_release_params() where metadata_dst is released synchronously via dst_release() while the old params are freed with kfree_rcu(), allowing a con...

EUVD-2026-55563

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68377 net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-71956

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

CVE-2026-71956

CVE-2026-71956 affects D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044. The vulnerability is a command injection in the app.cgi interface that lets a remote attacker inject arbitrary commands into the netDig.ping.dst field, resulting in root-level comma...

SUSE CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

UBUNTU-CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

CVE-2026-64581 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

CVE-2026-64581 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...