CVE-2026-97984

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local user could cause a Denial of Service DoS by exploiting an integer overflow in the User Datagram Protocol UDP length calculation. When Path MTU Discovery is enabled on a network device configured with an unusually large...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: icmp: Fixed a NULL pointer dereference in icmptagvalidation. icmptagvalidation unconditionally dereferes the result of rcudereferenceinetprotosproto without checking for NULL. The inetprotos array is sparse—only about 15 out o...

EUVD-2026-86638

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

PT-2026-98672

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets qdisc change falls back to psched mtu with no floor for bands without an explicit quantum. With a crafted size table qdisc pkt len reaches 2 GiB, so a zero psched mtu ...

CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

CVE-2026-95508

libslirp , a userspace network stack, contains a heap-based buffer overflow in its DHCPv6 and TFTP response builders. When the host is configured with a small interface MTU (below the IPv6 minimum link MTU of 1280), a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the r...

CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

Linux Distros Unpatched Vulnerability : CVE-2026-90073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU...

DEBIAN-CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

DEBIAN-CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

AZL-102557 CVE-2026-90073 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

EUVD-2026-81949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90088

CVE-2026-90088 affects the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_apply_pn() accepts an MTU value from a remote Parameter Negotiation (PN) frame without validating it against zero. When a remote peer sends an MTU of zero, the sendmsg path enters an infinite loop during data ...

CVE-2026-90088 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90076 net/sched: fq: add overflow bounds to quantum and initial quantum

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

CVE-2026-90075

In the Linux kernel , the fq_codel qdisc (net/sched) fails to clamp the default quantum and codel mtu derived from psched_mtu(). A device whose MTU wraps the value into the sign bit (e.g., a dummy device with max_mtu == 0 accepting MTU 2147483634) causes two distinct failures: (1) the signed flow...

EUVD-2026-81934

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...