CVE-2025-6563

MikroTik 핫스팟 로그인 페이지 반사형 XSS 취약점 권고 개요 MikroTik RouterOS 핫스팟 로그인 페이지에서 반사형 XSSCross-Site Scripting 취약점이 발견되었습니다. 이 취약점은 dst URL 매개변수를 통해 트리거되며, 입력값이 제대로 삭제sanitize되지 않아 피해자 브라우저에서 악성 JavaScript 코드가 실행될 수 있습니다. 영향을 받는 제품 MikroTik RouterOS 핫스팟 로그인 페이지 7.20 미만 버전 취약점 세부 정보 공격자가 다음과 같은 URL을 조작하면 취약점이...

PT-2026-90281

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect md mode when metadata dst allocation fails In collect md mode ipip tunnel rcv returns 0 without freeing the skb when ip tun rx dst fails to allocate the metadata dst. ipip rcv and mplsip rcv are...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098938)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098938 advisory. In the Linux kernel, the following vulnerability has been resolved: net: use dstdevrcu in sksetupcaps Use RCU to protect accesses to dst-dev from sksetupcaps and...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memory leak in fib6rulesuppress The kernel causes a memory leak when a fib rule is present in IPv6 nftables firewall rules, and a suppressprefix rule is present in IPv6 routing rules used by certain tools such as...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Fixed an issue where the dstclone function was used, but the result was set incorrectly. This issue arises because the entry might have a reference count of 0 or be already deleted, causing various problems...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: macsec: Fixed a use-after-free issue during the sending of the offloading packet. KASAN reports the following UAF. The metadatadst, which is used to store the SCI value for macsec offloading, is already freed by metadatadstfre...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU virtual crypto device during handling of data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the values of srclen and dstlen in virtiocryptosymophelper, which may lead to a heap buffer overflow if these values differ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: fixed a memory leak in tcpconnrequest. If inetcskreqskqueuehashadd returns false, tcpconnrequest will return without freeing the dst memory, which was allocated in afops-routereq. Here is the stack trace for the issue:...

PT-2026-79700

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf flow table: drop existing skb dst before skb dst set noref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dst entry assigned during earlier RX ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102020)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102020 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6inputcore and rplinput call...

CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

UBUNTU-CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

PT-2026-72261

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec del rxsc ctx freed the per-SC metadata dst with metadata dst free, which kfrees the object unconditionally an...

PT-2026-72441

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: validate skb dst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relie...

PT-2026-72592

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup bearer due to premature dst cache destroy TIPC UDP media bearer teardown calls dst cache destroy on its replicast caches before calling synchronize net to wait for concurrent RCU readers transmitters to...

PT-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dst entry is provided to check the skb headroom and to set the iph-frag off field...

PT-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use correct direction to set up tunnel route The layer 2 encapsulation and layer 3 tunnel information in the xmit path is taken from the other tuple, because the tunnel information that is included in the...