Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100370 advisory. In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a sing...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099739 advisory. In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a sing...

CVE-2026-72404

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

CVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

EUVD-2026-59328

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

EUVD-2026-59303

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

EUVD-2026-53275

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

CVE-2024-56751

In the Linux kernel, the following vulnerability has been resolved: ipv6: release nexthop on device removal The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test: unregisternetdevice: waiting for vethA-R1 to become free. Usage count = 6 reftracker:...

UBUNTU-CVE-2024-41081

In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ilaoutput As explained in commit 1378817486d6 "tipc: block BH before using dstcache", net/core/dstcache.c helpers need to be called with BH disabled. ilaoutput is called from lwtunneloutput possibly from process...

CVE-2024-41081 ila: block BH in ila_output()

In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ilaoutput As explained in commit 1378817486d6 "tipc: block BH before using dstcache", net/core/dstcache.c helpers need to be called with BH disabled. ilaoutput is called from lwtunneloutput possibly from process...

CVE-2024-41081

CVE-2024-41081 is addressed in newer Linux kernel packages for Amazon Linux 2 - Kernel-5.15 Extra. The advisory documents a race in ila_output() where ila_output() may be invoked under rc u_read_lock() and potentially interrupted by softirq, risking corruption of dst_cache data structures. The fi...

CVE-2024-36971 net: fix __dst_negative_advice() race

In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race dstnegativeadvice does not enforce proper RCU rules when sk-dstcache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk-skdstcache, then call dstreleaseolddst. Note...

CVE-2024-36971

CVE-2024-36971 is a Linux kernel vulnerability where __dst_negative_advice() did not enforce correct RCU rules when sk->dst_cache needed clearing, allowing a possible use-after-free. The issue arises from the wrong clearance order relative to dst_release(old_dst); ip6_negative_advice() has spe...