CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

CVE-2026-99112

The Linux kernel contains a vulnerability in net/sched: cls_flower where the fl_set_enc_opt() function fails to adequately validate the mask pointer after calling nla_next(). Because the mask cursor is driven by the number of key attributes rather than the mask's own attributes, a mask with trail...

CVE-2026-99112 net/sched: cls_flower: validate mask pointer after nla_next()

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

EUVD-2026-112012

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

UBUNTU-CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...