137829 matches found
EUVD-2026-45690
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6test netns ns2 ip -n ns2 link set vti6test type vti6 remote ::3...
CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...
CVE-2026-63914 xfrm: route MIGRATE notifications to caller's netns
In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrmsendmigrate in net/xfrm/xfrmuser.c and pfkeysendmigrate in net/key/afkey.c both hardcode &initnet for the multicast that announces a successful XFRMMSGMIGRATE / SADBXMIGRATE...
CVE-2026-63912 xfrm: esp: restore combined single-frag length gate
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...
CVE-2026-63913 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...
CVE-2026-63912
The CVE concerns the Linux kernel XFRM/ESP path. The vulnerability arises in the ESP out-of-place fast path where an out-of-line trailer is written before dest page frag allocation; the head gate and tail code previously treated skb->data_len and tailen separately, risking an overflow when the...
CVE-2026-63913 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...
CVE-2026-63913
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...
CVE-2026-63874
In the Linux kernel, CVE-2026-63874 affects the MCTP USB path (net: mctp: usb). The vulnerability arises from a race between urb completion and rx_retry cancellation during ndo_stop, which could leave an urb queued and re-schedule rx_retry_work. The fix strengthens sequencing between stopping and...
CVE-2026-63871 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...
EUVD-2026-45555
In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...
CVE-2026-63870
The CVE-2026-63870 issue affects linux ieee802154/6lowpan where non‑IPv6 packets (e.g., from an aoe driver) queued for transmission on a 6LoWPAN interface bypass the IPv6 check. The header creation function returns early and leaves lowpan_addr_info uninitialized in skb headroom; the transmit path...
CVE-2026-63868
The Linux kernel contains an unsigned integer underflow vulnerability in the garp_pdu_parse_attr function within the net: garp subsystem. The vulnerability occurs because the receive-side GARP attribute parser computes the data length (dlen) using reversed operands: dlen = sizeof(*ga) - ga->le...
CVE-2026-63868
In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...
CVE-2026-63837 net: ena: PHC: Check return code before setting timestamp output
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...
CVE-2026-63837
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...
CVE-2026-63837
The CVE affects the Linux kernel ENA PHC path. In ena_phc_gettimex64, the output timestamp was written to the user via the PTP ioctl regardless of whether ena_com_phc_get_timestamp() succeeded. If an error occurs (e.g., PHC disabled or blocked), the timestamp could contain uninitialized memory or...
CVE-2026-63803
In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...
CVE-2026-63829 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...