40 matches found
SUSE CVE-2026-98968
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
DEBIAN-CVE-2026-98968
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
CVE-2026-98968
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
CVE-2026-98968
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
CVE-2026-98968 amt: send the relay's General Query directly from the receive path
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
CVE-2026-98968 amt: send the relay's General Query directly from the receive path
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
CVE-2026-98968
The Linux kernel contains a use-after-free vulnerability in the amt driver. A socket buffer (skb) queued in a qdisc can outlive the tunnel it references because the tunnel pointer is stored as a raw pointer in skb->cb. Specifically, if a tunnel expires and is freed while a packet (e.g., one wi...
EUVD-2026-108762
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 5.16. It arises because amt devices’ buffers of skb objects reference the original pointers within their skb-cb fields. When these buffers are released due to a tunnel expiration, subsequent enqueuing operations trigger reuse after release i...
PT-2026-121945
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...
CVE-2026-98325
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...
kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This use-after-free vulnerability arises from incorrect handling of fast-RX rate data during mesh processing. This can lead to memory corruption, which an attacker could potentially exploit to cause a system crash denial of service...
kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This use-after-free vulnerability arises from incorrect handling of fast-RX rate data during mesh processing. This can lead to memory corruption, which an attacker could potentially exploit to cause a system crash denial of service...
PT-2026-72246
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf ct handle fragments function calls nf ct handle fragments without saving and restoring the skb-cb control buffer. Because the...
Linux Kernel Security Vulnerabilities
The Linux kernel version 6.4 has a reuse vulnerability after memory release. This vulnerability arises from the failure to capture the fast-RX rate during mesh reuse of skb-cb. As a result, after the ieee80211rxmeshdata function clears the released memory, stastastatsencoderate still accesses the...
kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash denial of...
Linux Distros Unpatched Vulnerability : CVE-2026-43037
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip4ip6err Oskar Kjos reported the following problem. ip4ip6err...
CVE-2026-43037 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip4ip6err Oskar Kjos reported the following problem. ip4ip6err calls icmpsend on a cloned skb whose cb was written by the IPv6 receive path as struct inet6skbparm. icmpsend passes IPCBskb2 to...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006738)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006738 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvti: fix potential slab-use-after-free in decodesession6 When ipvti device is set to the qdisc ...
AZL-78449 CVE-2026-22977 affecting package kernel for versions less than 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sockrecverrqueue skbufffclonecache was created without defining a usercopy region, 1 unlike skbuffheadcache which properly whitelists the cb field. 2 This causes a usercopy BUG when...