CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-68477 ipvs: fix more places with wrong ipv6 transport offsets

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

CVE-2026-68477

CVE-2026-68477 relates to the Linux kernel IPVS handling of IPv6 transport offsets. The vulnerability stems from code paths that continued to assume an IPv4 network header after the ipv6 switch, causing incorrect IPv6 transport offset handling for TCP and related paths, and potentially impacting ...

CVE-2026-68477 ipvs: fix more places with wrong ipv6 transport offsets

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

EUVD-2026-59099

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

PT-2026-72617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A type confusion issue exists in the IPv6 IOAM In-situ Operations, Administration, and Maintenance implementation. The system uses a dummy dst entry null dst within the ioam6 lwt structu...

CVE-2026-74561: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

PT-2026-73015

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel. The function rds tcp laddr check retrieves a scoped IPv6 interface using dev get by index rcu but releases the RCU read-side lock...

PT-2026-73014

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel during nexthop replacement. The functions fib6 check nh list and nexthop replace notify traverse the nh-f6i list without holding th...

CVE-2026-72429: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

PT-2026-73013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel within the nh rt cache flush function, which is inlined into rtm new nexthop. The problem occurs when nh rt cache flush traverses t...

PT-2026-72189

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPVS component where incorrect IPv6 transport offsets are used. The TCP application code incorrectly assumes an IPv4 network header even when the ipvsh argument is...

CVE-2026-72021: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

PT-2026-72210

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPVS IP Virtual Server component where the set sctp state function incorrectly reads the SCTP chunk header for IPv6 packets containing extension headers. Instead o...

CVE-2026-68477: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

PT-2026-72536

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ip6tables component where malformed IPv6 extension headers could bypass rules intended to drop them. The ah, hbh, and rt matches verify the presence of t...

PT-2026-72690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 TCP implementation where the ip6 default advmss function can return a value of 65535 IPV6 MAXPLEN when the Maximum Transmission Unit MTU is large. This value ...

CVE-2026-72250: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...