CVE-2026-72061

A flaw was found in the Linux kernel. An incorrect permission check in the ipip6changelink function, which manages IPv6 over IPv4 SIT tunnels, allows a local attacker to bypass intended security restrictions. A user with administrative capabilities CAPNETADMIN in one network namespace a virtualiz...

CVE-2026-72055

A flaw was found in the Linux kernel's ip6vti component, which handles IPv6 Virtual Tunnel Interfaces. A local attacker with certain network administration privileges in one isolated network environment network namespace could exploit this vulnerability. This allows them to modify the configurati...

CVE-2026-72054

A flaw was found in the Linux kernel's ipvti component. An attacker with CAPNETADMIN privileges in one network namespace netns but not in another, can exploit an insufficient capability check in the vtichangelink function. This allows them to rewrite a Virtual Tunnel Interface VTI tunnel that...

CVE-2026-72053

A flaw was found in the Linux kernel's ipip networking component. A local attacker with certain network administration capabilities in one network namespace could exploit an insufficient permission check in the ipipchangelink function. This could allow them to modify the configuration of a networ...

CVE-2026-72051

A flaw was found in the Linux kernel's IPv6 tunnel ip6tunnel handling. A local attacker, privileged in one network namespace but not another, could exploit a missing capability check in the ip6tnlchangelink function. This vulnerability allows the attacker to modify an IPv6 tunnel residing in a...

BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

SUSE CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

SUSE CVE-2026-74484

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74484

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

UBUNTU-CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

UBUNTU-CVE-2026-74484

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74544

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74484

CVE-2026-74484 concerns the Linux kernel’s binfmt_misc feature: an entry registered with the character 'F' can cause the interpreter to pin itself, preventing proper unregistration and leading to a DoS with leaked resources (including user namespaces). The issue arises when the interpreter’s file...

EUVD-2026-59677

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74485 binfmt_misc: reject a flag character as the field delimiter

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...

CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...

CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...