CVE-2026-98614

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

CVE-2026-98614

The Linux kernel contains a vulnerability in the SCTP stack where the sctp_assoc_update_retran_path() function can enter an infinite loop. This occurs when all remaining transports, including the retran_path, are in the SCTP_UNCONFIRMED state, because the state check precedes the wraparound test,...

CVE-2026-98614 sctp: avoid livelock while updating retransmit path

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

CVE-2026-98614

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed corruption of urgent data during multi-segment retransmits. On the normal xmit path, when in urgent mode, we refuse to construct a multi-segment TSO packet. Therefore, each segment has its own urgptr. c / tcpwritexmit ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the tcpdisconnect function, the tcpsksk-fastopenrsk field was not cleared. The syzbot reported that a socket had tcpsksk-fastopenrsk in the TCPESTABLISHED state. syzbot reused the server-side TCP Fast Open socket as a new clie...

CLSA-2026-1790933161 openssl: Fix of 2 CVEs

CVE-2026-84782: reset s-initoff to 0 in dtls1retransmitmessage and skip retransmission in dtls1handletimeout while a handshake write is suspended, preventing a DTLS retransmit from being sent from a stale buffer offset - CVE-2026-35189: defer building the full nameRelativeToCRLIssuer distribution...

SUSE CVE-2026-90054

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

AZL-102498 CVE-2026-90054 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

DEBIAN-CVE-2026-90054

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054 tcp: fix corruption of urgent data on multi-segment retransmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

EUVD-2026-81915

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054

CVE-2026-90054 affects the Linux kernel TCP retransmit path. The root cause is a missing urgent-mode guard in __tcp_retransmit_skb(): unlike the normal transmit path, it builds multi-segment GSO packets while in urgent mode. Because urg_ptr is an offset from each segment's own sequence number but...

CVE-2026-90054 tcp: fix corruption of urgent data on multi-segment retransmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90054: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

PT-2026-94402

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP retransmit path where the system fails to restrict the creation of multi-segment packets while in urgent mode. Unlike the normal transmission path, the tcp...

CVE-2026-52924

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctpstreamupdate is only invoked when the association is moved into COOKIEWAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state...

CVE-2026-46158

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount When an ADDADDR is retransmitted, the sk is held in skresettimer. It should then be released in all cases at the end. Some unlikely checks were returning directly instead of...

CVE-2026-46170 mptcp: pm: ADD_ADDR rtx: free sk if last

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: free sk if last When an ADDADDR is retransmitted, the sk is held in skresettimer, and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sockput should...