CVE-2026-68335 rds: drop incoming messages that cross network namespace boundaries

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

EUVD-2026-55424

In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipcudprcastadd and cleanupbearer both update ub-rcast.list with listaddrcu / listdelrcu, but nothing serializes them. The add runs from the encap receive softirq via...

CVE-2026-68323

A race condition was found in the Linux kernel TIPC UDP bearer replication list handling (tipc_udp_rcast_add and cleanup_bearer). Without proper serialization, updates to ub->rcast.list can corrupt the list, potentially triggering a kernel bug and denial of service. The fix adds a spinlock to ...

CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

EUVD-2026-55402

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68300

Summary: CVE-2026-68300 in the Linux kernel concerns SCTP authentication. The function sctp_auth_chunk_verify() incorrectly returns true when auth_chunk is NULL, allowing authentication to be bypassed under certain conditions (e.g., skb_clone() failure in BH path or absence of an AUTH before COOK...

EUVD-2026-55378

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68244

The CVE relates to the Linux kernel DRM/I915 GEM component. After a BALANCE/PARALLEL_SUBMIT extension during context creation, an error in processing the next user extension could leak the siblings[] array; this has been resolved. The fix is cherry-picked from commit aa65e0a4b51b3b54b53e4142aaa2d...

CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68161

Summary of CVE-2026-68161 : In the Linux kernel, SCTP UDP tunnel sockets created per-net SCTP UDP port (net.sctp.udp_port) are not stopped when a network namespace (netns) is torn down, potentially leaving sockets installed during teardown. The root cause is that the netns exit path does not stop...

EUVD-2026-55547

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

EUVD-2026-55526

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68142

The CVE concerns the Linux kernel geneve driver. A local attacker with CAP_NET_ADMIN in one network namespace can bypass permission checks and modify a geneve network device in a different namespace, potentially enabling unauthorized network configuration changes or disruption. The fix gates the ...

CVE-2026-68137 net/x25: fix use-after-free in x25_kill_by_neigh()

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

EUVD-2026-55518

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

CVE-2026-68137 net/x25: fix use-after-free in x25_kill_by_neigh()

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

CVE-2026-68134 ptp: ptp_s390: Add missing facility check

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68134

The CVE-2026-68134 entry concerns the Linux kernel ptp_s390 module. The vulnerability arises from a missing facility check that could allow the physical clock to be registered even when facility 28 is not installed or PTFF QPT is unavailable. The public details in the connected sources indicate t...