CVE-2026-74695

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

CVE-2026-74695

A reference count leak in the Linux kernel's netfilter flowtable module occurs when skb_dst_set_noref() is called on a socket buffer that already holds a ref-counted dst_entry from earlier RX or routing steps. The overwrite of skb->_skb_refdst leaks the prior reference and triggers a DEBUG_NET...

EUVD-2026-64382

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

Linux Distros Unpatched Vulnerability : CVE-2026-74695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might...

Linux Distros Unpatched Vulnerability : CVE-2026-72429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This d...

UBUNTU-CVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

UBUNTU-CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

CVE-2026-72429

In CVE-2026-72429, the Linux kernel IOAM code had a type confusion with dst_entry embedded in ioam6_lwt. The IPv6 dst cache path could treat this embedded dst_entry as a rt6_info, triggering an invalid cast and potential invalid pointer access via rt6_get_cookie(), especially if rt->sernum is ...

CVE-2026-72429 ipv6: ioam: fix type confusion of dst_entry

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72248

The CVE-2026-72248 entry pertains to the Linux kernel netfilter flowtable: IPIP tunnels with direct xmit can crash the tunnel transmit path due to missing dst_entry when checking headroom and setting iph->frag_off. The workaround/patch moves dst_cache and dst_cookie out of the runtime union so...

EUVD-2026-59147

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

CVE-2021-46955

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds...

CVE-2021-46955 openvswitch: fix stack OOB read while fragmenting IPv4 packets

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds...

CVE-2021-46954 net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

In the Linux kernel, the following vulnerability has been resolved: net/sched: schfrag: fix stack OOB read while fragmenting IPv4 packets when 'actmirred' tries to fragment IPv4 packets that had been previously re-assembled using 'actct', splats like the following can be observed on kernels built...

CVE-2021-46954

In the Linux kernel, the following vulnerability has been resolved: net/sched: schfrag: fix stack OOB read while fragmenting IPv4 packets when 'actmirred' tries to fragment IPv4 packets that had been previously re-assembled using 'actct', splats like the following can be observed on kernels built...