CVE-2026-63920

The CVE-2026-63920 entry describes a Linux kernel vulnerability in IPv6 extension header handling. The issue arises when ip6_datagram_recv_specific_ctl() builds IPV6_…cmsgs by trusting on-wire hdrlen (ptr[1]) during put_cmsg() length calculation. Although the write to hdrlen is in-bounds, reading...

CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-63917 ip6: vti: Use ip6_tnl.net in vti6_changelink().

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6test netns ns2 ip -n ns2 link set vti6test type vti6 remote ::3...

CVE-2026-63870 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...

OESA-2026-3094 nmap security update

Nmap "Network Mapper" is a free and open source license utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts. Security Fixes: Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured...

Updated nmap packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer Underflow in IPv6 Extension Header Parsing. CVE-2026-58058...

CVE-2026-63920: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-64132: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-63969: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-64116: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6hopioam Reported by Sashiko: The function ipv6hopioam accesses in6devgetskb-dev-cnf.ioam6enabled without validating the returned idev pointer. Because addrconfifdown can concurrently cle...

PT-2026-61433

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the Linux kernel when processing an IOAM Hop-by-Hop option. The function ipv6 hop ioam accesses in6 dev getskb-dev-cnf.ioam6 enabled without validati...

CVE-2026-63912: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63984: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

PT-2026-61301

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the ipv6 rpl srh decompress function when processing Routing Header SRH decompression. The hdrlen variable, defined as u8, fails to hold values when n is 12...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of IPv6 transition addresses in the outbound URL guard, which allows an attacker to bypass SSRF protections and access internal services or cloud metadata endpoints through a malicious RSS feed...

SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3089-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3089-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3083-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3083-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.60 fixes various security issues The following security issues were fixed: -...

GO-2026-5996 ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

ToolHive: SSRF guard misses IPv6 NAT64 ranges 64:ff9b::/96, 64:ff9b:1::/48, allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive...

GO-2026-5997 safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl

safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl...

CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...