CVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

UBUNTU-CVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

EUVD-2026-55393

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

CVE-2026-68292 ice: prevent tstamp ring allocation for non-PF VSI types

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

CVE-2026-68292 ice: prevent tstamp ring allocation for non-PF VSI types

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

EUVD-2026-55514

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

CVE-2026-68133

The CVE concerns the Linux kernel ice driver’s PTP handling. A PF reset when PTP state is ICE_PTP_UNINIT could cause ice_ptp_rebuild() to set the state to ICE_PTP_ERROR, producing a PTP release call trace during driver unload (ice_ptp_release -> ice_deinit_features.part.0 -> ice_remove). Th...

CVE-2026-68133 ice: fix PTP Call Trace during PTP release

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

CVE-2026-68128 ice: reject out-of-range ptype in ice_parser_profile_init

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

CVE-2026-68128

CVE-2026-68128 affects the Linux kernel ice driver. The vulnerability arises when a malicious VF can supply an out-of-range ptype (>= ICE_FLOW_PTYPE_MAX, 1024) via VIRTCHNL, causing a write past the end of a bitmap in ice_parser_profile_init and a kernel page fault. Reproduced on a system with...

CVE-2026-68128 ice: reject out-of-range ptype in ice_parser_profile_init

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

RLSA-2026:51295 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: ioam: fix heap buffer overflow in ioam6filltracedata CVE-2026-43186 Bug Fixes and Enhancements: kernel panics caused by NULL pointer dereferences within octeonepvf rhel-10.2.z...

RockyLinux 10 : kernel (RLSA-2026:51295)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:51295 advisory. kernel: ipv6: ioam: fix heap buffer overflow in ioam6filltracedata CVE-2026-43186 Bug Fixes and Enhancements: kernel panics caused by NULL pointer dereferences...

RHEL 10 : kernel (RHSA-2026:51295)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51295 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: ioam: fix heap buffer overflow ...

Moderate: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Improper Input Validation

pion/stun is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of malformed short XOR-MAPPED-ADDRESS attributes in XORMappedAddress.GetFromAs, which allows a remote attacker to trigger a panic by sending specially crafted STUN or ICE Binding responses...

CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

GHSA-28GM-JRMW-XX93 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

Oracle Linux 10 : kernel (ELSA-2026-42919)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42919 advisory. - fanotify: fix false positive on permission events CKI Backport Bot RHEL-180076 CVE-2026-46150 - ice: fix double-free of txbuf skb Jakub Ramaseuski...