CVE-2026-98096 ipv6: sr: restore network header before routing and forwarding

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

EUVD-2026-86926

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-98096 ipv6: sr: restore network header before routing and forwarding

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-97984 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

EUVD-2026-86638

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97984

The Linux kernel contains a vulnerability where UDP sockets can experience a UDP length overflow when using IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE options. This occurs when sending a large packet over a network device with an unusually large MTU (greater than IP6_MAX_MTU), causing the 16-bit len...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97974 ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97974

The Linux kernel contains a null-pointer dereference vulnerability within the ipv6 networking stack, specifically in the __ip6_del_rt_siblings() function. The issue occurs because rt->fib6_node can be set to NULL by a concurrent thread (e.g., when replacing an ECMP route via RTM_NEWROUTE with ...

EUVD-2026-86628

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97974

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97939 ipmr: account multicast table and route memory

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

EUVD-2026-86794

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

EUVD-2026-86793

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

CVE-2026-97940

The Linux kernel is affected by a Use-After-Free (UAF) vulnerability in the ipv6 component. The issue arises because ipv6_route_iter_active() incorrectly treats a walker in FWS_U at the table root as already unlinked. This allows fib6_del_route() to move a still-linked walker into that state when...

CVE-2026-97602 inet: frags: invalidate queues before flushing them

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...

CVE-2026-97597 ipv6: flowlabel: cap duplicate leases per socket

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6flowlabelget allocates an ipv6flsocklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease...