kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP subsystem. A local unprivileged user can exploit this vulnerability by creating a new user namespace and bypassing authorization checks for unattached administrative input/output controls ioctls. This allows the user to perform...

kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

A flaw was found in the Linux kernel. A race condition exists in the xfrm policy handling, specifically within the xfrmpolicybyselctx function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial...

kernel: netfilter: conntrack_irc: fix possible out-of-bounds read

A flaw was found in the Linux kernel's netfilter conntrackirc module. This vulnerability allows for a possible out-of-bounds read. When parsing network traffic, if a command string is matched but subsequent parsing fails, the system does not properly exit, leading to the flaw. This could...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

kernel: netfilter: require Ethernet MAC header before using eth_hdr()

A flaw was found in the Linux kernel's netfilter component. Certain netfilter modules, including ip6teui64 and xtmac, accessed Ethernet MAC header data without first verifying that an Ethernet device was associated with the network packet or that the MAC header was present and of sufficient lengt...

kernel: ipv6: sit: reload inner IPv6 header after GSO offloads

A flaw was found in the Linux kernel's Simple Internet Transition SIT tunnel driver for IPv6. When processing network traffic with Generic Segmentation Offload GSO enabled, the driver may use a stale pointer to the inner IPv6 header after the socket buffer skb head has been reallocated. This can...

kernel: xfrm: hold dev ref until after transport_finish NF_HOOK

A flaw was found in the Linux kernel's xfrm IP eXtensible FRamework subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting t...

kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

A flaw was found in the Linux kernel's Internet Small Computer System Interface iSCSI Extensions for Remote Direct Memory Access RDMA iSER module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow...

kernel: net: guard timestamp cmsgs to real error queue skbs

A flaw was found in the Linux kernel's networking component. This vulnerability allows a remote attacker to potentially access sensitive information or cause system instability. By sending specially crafted network packets, an attacker can exploit an issue in how the kernel handles timestamping f...

kernel: ipv6: mcast: Fix use-after-free when processing MLD queries

A flaw was found in the Linux kernel's IPv6 multicast mcast component. When processing Multicast Listener Discovery MLD queries, a pointer to the multicast group address is not correctly reloaded after certain packet manipulations. This can lead to a use-after-free vulnerability, potentially...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

[SECURITY] [DLA 4782-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4782-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 17, 2026 https://wiki.debian.org/LTS -...