EUVD-2026-103577

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98532

The Linux kernel is vulnerable to an out-of-bounds read and write in the IPv6 processing logic. The ipv6_find_hdr() function walks the extension header chain but fails to check if the skip amount exceeds the packet length (skb->len). This allows the function to return an offset pointing past t...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...