CVE-2026-74746: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

Linux Distros Unpatched Vulnerability : CVE-2026-74746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original nod...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098831)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098831 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release flowtable after rcu grace period on error Call synchronizercu after...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: The iph-ihl field was validated in the nfflowip4tunnelproto function. A sanity check was added for this field before using it to calculate the header size. This prevents out-of-bounds access and malformed IP...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Use dst in this direction when pushing the IPIP header. When pushing the IPIP header, the route of the other direction is used to calculate the headroom. Instead, use the route in this direction. Accessing t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: flowtable: fixed and simplified the handling of IP6IP6 tunnels. Fixed the nfflowip6tunnelproto function to use pskbmaypull instead of skbheaderpointer, to ensure that the outer IPv6 header is within the skb headroom...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Support for IPIP tunnels with direct xmit. The combination of IPIP tunnels with direct xmit—for example, in the case of bridge devices—results in an issue because no dstentry is provided to check the...

CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

SUSE CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

SUSE CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

CVE-2026-72442

A flaw was found in the Linux kernel's netfilter flowtable, which manages network packet processing. The system incorrectly handled IPv6-in-IPv6 IP6IP6 tunneled packets, specifically in how it processed the outer IPv6 header. This could lead to improper network traffic management, potentially...

CVE-2026-72417

A flaw was found in the Linux kernel's netfilter flowtable component. Insufficient validation of the iph-ihl field in the nfflowip4tunnelproto function, when processing malformed IP Internet Protocol headers, could lead to an out-of-bounds access. This vulnerability could allow a remote attacker ...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

CVE-2026-72249

A flaw was found in the Linux kernel's netfilter flowtable. When processing the IP-in-IP IPIP header, the system incorrectly uses routing information from the opposite direction to calculate packet headroom and fragmentation flags. This can lead to incorrect packet handling and potentially affect...

CVE-2026-72246

A flaw was found in the Linux kernel's netfilter flowtable component. This vulnerability arises from an error in how the system sets up tunnel routes, specifically in handling network packet encapsulation and tunnel information. An attacker could potentially exploit this to cause incorrect networ...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

Linux Distros Unpatched Vulnerability : CVE-2026-72249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IP...

Linux Distros Unpatched Vulnerability : CVE-2026-72442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to us...

Linux Distros Unpatched Vulnerability : CVE-2026-72417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl...