CVE-2026-74670

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the initial setup of the IPVS estimator, if the network namespace is removed, the estimator may continue operating with uninitialized limits. This can lead to an out-of-bounds write when processing network statistics,...

CVE-2026-74715

A flaw was found in the kernel. A reference imbalance vulnerability exists in the Berkeley Packet Filter BPF conntrack kfuncs. This occurs when the 'opts' argument, which can point to a shared map value, has its network namespace identifier netnsid read separately during reference acquisition and...

SUSE CVE-2026-74615

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-74715

This vulnerability affects the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The root cause is a race condition : the opts->netns_id field is read separately when acquiring and releasing the network namespace reference. Because opts can point to a shar...

EUVD-2026-64402

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74615

CVE-2026-74615 is a slab-use-after-free in the Linux kernel's VXLAN driver. The root cause is that vxlan_changelink() arms the ageing timer without a netif_running() check, so the timer remains queued even when the device is never brought up. When the netdev is subsequently freed via free_netdev(...

CVE-2026-74544

A flaw was found in the Linux kernel's clsu32 module. An unprivileged user, through user or network namespaces, could provide a specially crafted offshift value that is not properly validated. This improper validation leads to a shift-out-of-bounds condition, resulting in undefined behavior and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102024 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: set netnsimmutable on the fallback device. john1988 and Noam Rathaus reported that...

kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()

A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...

kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()

A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...

CVE-2026-72136

A flaw was found in the Linux kernel's xfrminterface component. A local attacker with specific network administration privileges in one network namespace could exploit this vulnerability to modify the configuration of a network interface in a different network namespace where they are not...

CVE-2026-72061

A flaw was found in the Linux kernel. An incorrect permission check in the ipip6changelink function, which manages IPv6 over IPv4 SIT tunnels, allows a local attacker to bypass intended security restrictions. A user with administrative capabilities CAPNETADMIN in one network namespace a virtualiz...

CVE-2026-72055

A flaw was found in the Linux kernel's ip6vti component, which handles IPv6 Virtual Tunnel Interfaces. A local attacker with certain network administration privileges in one isolated network environment network namespace could exploit this vulnerability. This allows them to modify the configurati...

CVE-2026-72054

A flaw was found in the Linux kernel's ipvti component. An attacker with CAPNETADMIN privileges in one network namespace netns but not in another, can exploit an insufficient capability check in the vtichangelink function. This allows them to rewrite a Virtual Tunnel Interface VTI tunnel that...

CVE-2026-72053

A flaw was found in the Linux kernel's ipip networking component. A local attacker with certain network administration capabilities in one network namespace could exploit an insufficient permission check in the ipipchangelink function. This could allow them to modify the configuration of a networ...

CVE-2026-72051

A flaw was found in the Linux kernel's IPv6 tunnel ip6tunnel handling. A local attacker, privileged in one network namespace but not another, could exploit a missing capability check in the ip6tnlchangelink function. This vulnerability allows the attacker to modify an IPv6 tunnel residing in a...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74544

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74290

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...