CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneverx syzbot triggered a bug in geneverx 1 Issue is similar to the one I fixed in commit 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" We have to save...

PT-2026-91791

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport header when sending VLAN-tagged frame In packet parse headers, when processing a VLAN-tagged frame, skb set network header is called to advance network header past the VLAN tag to the inner protoc...

AZL-99054 CVE-2026-80731 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

CVE-2026-80731

CVE-2026-80731 is an out-of-bounds write in the Linux kernel's networking subsystem, specifically in dev_validate_header() . When a process holding CAP_SYS_RAWIO sends a packet with a short link-layer header, the function zero-pads using a direct read of dev->hard_header_len . If the device is...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100190)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100190 advisory. In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that...

SUSE CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74473

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

CVE-2026-74473

CVE-2026-74473 affects the Linux kernel’s VXLAN path. The issue arises in route_shortcircuit() which originally used pskb_may_pull() to ensure a network header length, but skb->data points to the MAC header in vxlan_xmit(), making the check insufficient and risking reading beyond the pulled bu...

CVE-2026-72227

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

UBUNTU-CVE-2026-72227

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

CVE-2026-72227 batman-adv: mcast: avoid OOB read of num_dests header

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

Linux Distros Unpatched Vulnerability : CVE-2026-74474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the...

CVE-2026-74474: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

Linux Distros Unpatched Vulnerability : CVE-2026-74473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are...

CVE-2026-68121 pppoe: reload header pointer after dev_hard_header()

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-64505 usb: gadget: function: rndis: add length check for header

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

PT-2026-64673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the 6lowpan implementation. The function lowpan nhc do uncompression retrieves an NHC descriptor while holding the lowpan nhc lock. If the descriptor lac...

CVE-2026-63924

A flaw was found in the Linux kernel's handling of IPv6 extended headers. Specifically, the ipv6hopjumbo function, which processes jumbo payloads, can modify internal packet buffer skb pointers. However, the network header nh pointer is not recomputed after these modifications. This oversight cou...