EUVD-2026-103767

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

CVE-2026-98827: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

CVE-2026-80793

A flaw was found in the Linux kernel's IPv4 fragmentation handling. When processing IPv4 packets, if the Maximum Transmission Unit MTU is set to an unusually small value, the kernel's fragmentation logic can enter an infinite loop. This loop causes the system to continuously allocate and transmit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid infinite loops when trying to resize the local TT. If the MTU of one of the attached interfaces becomes too small to transmit the local translation table, then it must be resized to fit within all fragments when...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Handling of integer overflows in kmallocreserve The committed change was as follows: c ptr = kmallocsize; if ptr size = ksizeptr; size = kmallocsizeroundupsize; ptr = kmallocsize; This caused various crashes, as reported ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: Reject undersized MTUs in ipdofragment The ipdofragment function subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ipfragnext. If the effective MTU is smaller than hlen + 8,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb-transportheader is set in bpfskbcheckmtu. The bpfskbcheckmtu helper needs to use skb-transportheader when the BPFMTUCHKSEGS flag is used: bpfskbcheckmtuskb, ifindex, &mtulen, 0, BPFMTUCHKSEGS. The transportheader i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpmtuprobefloor. When reading sysctltcpmtuprobefloor, it can be changed concurrently. Therefore, we need to add READONCE to its reader...

CVE-2026-98393

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...

CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...

CVE-2026-98272

A flaw was found in the Linux kernel's Marvell mvpp2 network driver. This vulnerability can lead to a Denial of Service DoS due to an out-of-bounds memory access. A local user with network configuration privileges can trigger this issue by altering the Maximum Transmission Unit MTU, which causes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tipc: Do not update the MTU if msgmax is too small during MTU negotiation. During link MTU negotiation, a malicious peer may send an “Activate msg” with a very small MTU, e.g., 4, as tested by Shuang. Without checking for the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The sun4iCan driver does not populate the ndochangemtu function, allowing for a buffer overflow. Sending a PFPACKET message allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The on...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: Ensure a sane device MTU in tunnels Another syzbot report 1 indicates a bug in the ip6gre tunnel device: dev:ip6gretap0. Since the ipv6 mcast code ensures that the dev-mtu is read once and a sanity check is performed on it...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: macvlan: Enforces a consistent minimal MTU. macvlan should enforce a minimal MTU of 68, even when creating a link. This patch avoids the current behavior which could lead to crashes in the IPv6 stack if the link is brought up. ba...

CVE-2026-97984

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local user could cause a Denial of Service DoS by exploiting an integer overflow in the User Datagram Protocol UDP length calculation. When Path MTU Discovery is enabled on a network device configured with an unusually large...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

EUVD-2026-86638

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

PT-2026-98672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ets qdisc change function where it falls back to psched mtu without a minimum value for bands lacking an explicit quantum. When a crafted size table is used, qdisc...

CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...