CVE-2026-68335

Summary: CVE-2026-68335 relates to the Linux kernel Reliable Datagram Sockets (RDS) vulnerability where an incoming message can be delivered to a socket across network namespace boundaries due to a global rhashtable key that omits netns. This can cause a use-after-free when the sender’s netns is ...

EUVD-2026-55395

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

CVE-2026-68294

In CVE-2026-68294, the Linux kernel QRTR (Qualcomm IPC Router) allows an unprivileged process to create an AF_QIPCRTR socket in a separate network namespace, due to global state (qrtr_local_nid and qrtr_ports) not being partitioned per namespace. This enables cross-namespace QRTR datagrams and co...

CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

EUVD-2026-55391

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

CVE-2026-68186 binfmt_misc: set have_execfd only once the interpreter is opened

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68162

CVE-2026-68162 is a Linux kernel SCTP vulnerability (local) where a Use-After-Free can occur during netns teardown due to an auth_enable sysctl window. The bug stems from SCTP’s per-net sysctl state being registered before the control socket is fully established and remaining writable after inet_...

EUVD-2026-55548

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

EUVD-2026-55547

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68161

Summary of CVE-2026-68161 : In the Linux kernel, SCTP UDP tunnel sockets created per-net SCTP UDP port (net.sctp.udp_port) are not stopped when a network namespace (netns) is torn down, potentially leaving sockets installed during teardown. The root cause is that the netns exit path does not stop...

CVE-2026-68142

The CVE concerns the Linux kernel geneve driver. A local attacker with CAP_NET_ADMIN in one network namespace can bypass permission checks and modify a geneve network device in a different namespace, potentially enabling unauthorized network configuration changes or disruption. The fix gates the ...

CVE-2026-68142 geneve: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

EUVD-2026-55525

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

EUVD-2026-55499

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...

PT-2026-69954

Name of the Vulnerable Software and Affected Versions odh-model-controller affected versions not specified Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret function. The function improperly reads the Secret namespace from...

PT-2026-69562

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the SCTP implementation during network namespace teardown. The proc sctp do auth function updates the SCTP control socket after modifying the...

PT-2026-69914

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 2.0.4 Vault Enterprise versions prior to 1.21.9 Vault Enterprise versions prior to 1.20.14 Vault Enterprise versions prior to 1.19.20 Description The identity entity batch-delete endpoint is subject to a...