Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142743 advisory. In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header...

CVE-2026-90160

A flaw was found in the Linux kernel's Lightweight Tunnel BPF lwtbpf component. An attacker, by using a specially crafted BPF program, could cause an insufficient headroom condition after the program modifies the socket buffer skb head. This can lead to the kernel dropping network packets,...

pppoeject

PPPoEject — Linux kernel PPPoE use-after-free tracking site Source for the PPPoEject patch-status tracker: a single-page site recording which distributions have shipped a fix for the PPPoE sendmsg stale skb-head use-after-free in the Linux kernel. Where the facts live Everything about the bug — t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - Ensured that erspanbasehdr is present in skb-head. The issue is that ip6erspanrcv and erspanrcv no longer ensures that erspanbasehdr is present in the linear part of skb-head before retrieving the @ver field from it. Add the...

Linux Distros Unpatched Vulnerability : CVE-2026-89555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking th...

CVE-2026-89555 mpls: reload header after pskb_may_pull()

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...

CVE-2026-89555

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...

CVE-2026-81000

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

PT-2026-90108

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description IP tunnel devices derive their advertised needed headroom from lower output devices. In stacked configurations of user-created devices, this derived value can exceed the capacity of 16-b...

SUSE CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

PT-2026-86710

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route shortcircuit Before route shortcircuit, the eth header pointer is cached from eth hdrskb. Inside route shortcircuit, pskb may pull can be called, which may reallocate skb-head. In this case,...

CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-74269 bnxt: fix head underflow on XDP head-grow

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test testxdpnativeadjstheadgrowdata crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxtrxmultipageskb, which builds the s...

CVE-2026-68476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

SUSE CVE-2026-68121

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-68302

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr or the AMT message header and then call a helper that can reallocate that head befo...

CVE-2026-68121

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-68121 pppoe: reload header pointer after dev_hard_header()

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

EUVD-2026-55502

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...