CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72502 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

EUVD-2026-59401

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

CVE-2026-72442

The CVE-2026-72442 entry relates to the Linux kernel netfilter flowtable and IP6IP6 tunnel handling. A fix changes nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer(), ensuring the outer IPv6 header is in headroom for subsequent processing. The ctx->offset update ...

CVE-2026-72429 ipv6: ioam: fix type confusion of dst_entry

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

EUVD-2026-59328

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72429 ipv6: ioam: fix type confusion of dst_entry

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

CVE-2026-72429

In CVE-2026-72429, the Linux kernel IOAM code had a type confusion with dst_entry embedded in ioam6_lwt. The IPv6 dst cache path could treat this embedded dst_entry as a rt6_info, triggering an invalid cast and potential invalid pointer access via rt6_get_cookie(), especially if rt->sernum is ...

CVE-2026-72392 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

CVE-2026-72392 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

CVE-2026-72348 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

EUVD-2026-59247

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

CVE-2026-72348

The CVE-2026-72348 entry concerns the Linux kernel netfilter ip6tables handling of IPv6 extension headers (ah, hbh, rt). The issue stems from checks that derive the advertised extension header length from header length fields; improper advertised-length checks allowed malformed headers to bypass ...

CVE-2026-72348 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

CVE-2026-72322

CVE-2026-72322 concerns a race in the Linux kernel IPv6 multicast code (MLD delayed work) that can cause a Use-After-Free during device teardown and MLD query processing. The root cause is a use of in6_dev_hold() to take a reference on inet6_dev while it may already be freed (RCU-protected memory...

EUVD-2026-59149

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72250

The CVE-2026-72250 entry documents a Linux kernel vulnerability in netfilter nf_conntrack_reasm where IPv6 defragmentation erroneously adjusts skb->mac_header. Specifically, nf_ct_frag6_reasm() advances skb->mac_header after dropping the IPv6 fragment header, but on NF_INET_LOCAL_OUT the ma...

CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...