CVE-2026-72230 batman-adv: frag: free unfragmentable packet

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error...

CVE-2026-72065

The CVE-2026-72065 issue affects the Linux kernel networking path for mana devices: it fixes a vulnerability where the packet length reported by the NIC RX CQE could be unchecked before skb processing. The underlying problem is trusting CQE-reported lengths from the NIC and passing them to skb ha...

CVE-2026-72065 net: mana: Validate the packet length reported by the NIC

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

EUVD-2026-59023

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

CVE-2026-72064

CVE-2026-72064 relates to the Linux kernel net: mana RX path. When frag_count > 1, RX buffers are allocated from page pool fragments and remain DMA mapped; the RX completion path omits dma_unmap_single(), so the implicit CPU sync is not performed before passing data to the networking stack. Th...

CVE-2026-72021

Summary: The CVE-2026-72021 issue affects the Linux kernel’s IPVS SCTP state lookup. The kernel incorrectly read the SCTP chunk header using a wrong offset for IPv6 when extension headers were present, causing misclassification of handshake steps (e.g., INIT1 vs ESTABLISHED) and incorrect managem...

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

PT-2026-72536

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

PT-2026-72702

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch dualpi2: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce...

PT-2026-72208

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec encrypt macsec encrypt reads the Ethernet header via eth hdrskb skb-head + skb-mac header to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On th...

PT-2026-72484

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ife decode function where it may return after making only the outer IFE header and metadata pullable. When the decapsulated packet is subsequently passed to eth ty...

PT-2026-73002

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the system may send un-rate-limited ICMP/NDISC Redirect messages when peer allocation fails due to memory pressure or tree size caps. This occurs because the...

Linux Distros Unpatched Vulnerability : CVE-2026-74492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During...

PT-2026-72535

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt connmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark tg shift. A shift bits value of 32 or more...

PT-2026-72866

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc input ackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new servic...

Linux Distros Unpatched Vulnerability : CVE-2026-72347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user- controlled shift parameters and applies them to 32-bit ma...

Linux Distros Unpatched Vulnerability : CVE-2026-72065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is...

Linux Distros Unpatched Vulnerability : CVE-2026-72320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and...

PT-2026-72538

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt u32: reject invalid shift counts u32 match it executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during...