vopono

vopono は、一時的なネットワーク名前空間を介して VPN トンネル経由でアプリケーションを実行するためのツールです。これにより、メインの接続を通常のまま維持しながら、少数のアプリケーションだけを異なる VPN 経由で同時に実行できます。 vopono には Wireguard と OpenVPN の両方に対応した内蔵キルスイッチが含まれています。 現在、Mullvad、AzireVPN、MozillaVPN、ProtonVPN、iVPN、NordVPN、AirVPN、PrivateInternetAccess が直接サポートされており、--custom...

NetworkSandboxEngine

Network Sandbox Engine NSE 一个用于在隔离网络命名空间内进行确定性 nftables 防火墙测试 的 Linux 引擎。 为什么选择 NSE？ • 功能特性 • 环境要求 • 安装 • 快速开始 • 工作原理 • 项目结构 为什么选择 NSE？ 在运行中的 Linux 系统上测试防火墙规则集存在重大风险：格式错误的规则可能会中断 SSH 管理会话、在测试期间泄露明文流量，或在主机上留下孤立的防火墙表。 Network Sandbox Engine NSE 提供了一个安全、可复现的测试框架。它构建临时的 Linux 网络命名空间，连接虚拟以太网对，编译...

CVE-2026-98073

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by assigning conflicting alternative interface names to network devices across different network namespaces. When a non-root network namespace is deleted, the unresolved name conflict prevents the device from...

Linux Distros Unpatched Vulnerability : CVE-2026-97602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment whi...

vopono v1.0.2

vopono is a tool to run applications through VPN tunnels via temporary network namespaces. This allows you to run only a handful of applications through different VPNs simultaneously, whilst keeping your main connection as normal. vopono includes built-in killswitches for both Wireguard and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: skip expectations in other netns via proc This resolves the issue where expectations related to other netnames are skipped when processing network traffic. Similar to the issue addressed in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix ref leak when switching zones When switching zones or network namespaces without performing a ct clear in between, a reference to the old ct entry is still leaked. This occurs because tcfctskbnfctcached...

CVE-2026-68142

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

EUVD-2026-55436

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

CVE-2026-68335 rds: drop incoming messages that cross network namespace boundaries

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

CVE-2026-68335

Summary: CVE-2026-68335 relates to the Linux kernel Reliable Datagram Sockets (RDS) vulnerability where an incoming message can be delivered to a socket across network namespace boundaries due to a global rhashtable key that omits netns. This can cause a use-after-free when the sender’s netns is ...

PT-2026-69735

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.8 and later affected versions not specified Description A use-after-free issue exists in the Reliable Datagram Sockets RDS implementation. The rds find bound function uses a global rhastable keyed by address, port, and...

SUSE CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns

A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAPNETADMIN capability check in the rtnlnewlink function. This allows the user to create paired network devices in arbitrary network namespaces, including the...

MiracleLinux 8 : kernel-4.18.0-553.143.1.el8_10 (AXSA:2026-1337:51)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1337:51 advisory. - net/sched: ets: Always remove class from active list before deleting in etsqdiscchange CVE-2025-71066 - kernel: stale page table entries in IOMMU...

CVE-2026-63981

A flaw was found in the Linux kernel's net/sched: actmirred component. An unprivileged local user, by leveraging user namespaces to gain network administration capabilities, can create a specific network configuration that triggers an unbounded recursion. This recursion bypasses a depth limit...

EUVD-2026-45495

In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

SUSE CVE-2026-53077

In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in network namespaces other than the initial one. The existing RDS/IB code will not work properly in non-initial network namespaces...

CVE-2026-53077

A flaw was found in the Linux kernel's Reliable Datagram Sockets over InfiniBand RDS/IB component. This vulnerability allowed the use of RDS/IB in network namespaces other than the initial one, where the existing code would not function correctly. This improper operation could lead to unexpected...