EUVD-2026-76473

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89562

CVE-2026-89562 is a Linux kernel vulnerability in the ip6_gre module. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This misconfiguration affects both NBMA ip6gre tunnels (wher...

kernel: packet: use consistent hard_header_len in non-ring send paths

An out-of-bounds write problem was observed in packetsendmsgspkt in net/packet/afpacket.c in the Linux Kernel. In this flaw, AFPACKET hardheaderlen race may allow local privilege escalation...

CVE-2026-74747

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. A local attacker can manipulate the IP Header Length ihl field within network packets. This manipulation can lead to an out-of-bounds access when the kernel attempts to revalidate embedded headers, potentially causing system...

CVE-2026-65979 OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-65979

OpenEXR (the reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain an out-of-bounds read in the HTJ2K decoder . The decoder parses a header-length field (PLEN ) from a chunk's compressed data and advances the codestrea...

CVE-2026-74724

A flaw was found in the Linux kernel's IPVS IP Virtual Server component. A local attacker can exploit this vulnerability by manipulating packets processed by IPVS, specifically within the ipvsnaticmp function. This manipulation can lead to an out-of-bounds write due to improper handling of the IP...

CVE-2026-74701

A flaw was found in the Open vSwitch component of the Linux kernel. When a specially crafted packet with ETHPTEB protocol arrives on an ARPHRDNONE device, the keyextract function does not properly verify the Ethernet header length. This oversight allows a remote attacker to trigger a kernel bug,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv4, ipv6: Fixed the handling of transhdrlen in ip,6appenddata. Including transhdrlen in the packet length is a problem when the packet is partially filled e.g., a sendMSGMORE operation occurred previously when appending to a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/core: Fixed the ETHP1588 flow dissector. When an PTP Ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to skbflowdissect, the calculation of the nhoff value is incorrect. For example,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The hardcoded hdr2len parameter was replaced with the offsetof function in smb2calcmaxoutbuflen. After this commit e2b76ab8b5c9 "ksmbd: add support for read compound", the management of response buffers was changed to use ...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

CVE-2026-74701 net/openvswitch: check Ethernet header length in key_extract()

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

EUVD-2026-59126

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299

Summary: CVE-2026-68299 affects the Linux kernel vmxnet3 driver. When handling Geneve-encapsulated packets, vmxnet3_get_hdr_len() may misinterpret header fields because gdesc->rcd.v4/v6/tcp describe the outer header, while the inner header can differ. The completion descriptor’s VMXNET3_RCD_HD...

EUVD-2026-55400

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

UBUNTU-CVE-2026-67298

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...

CVE-2026-58662 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...