DEBIAN-CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

AZL-100806 CVE-2026-80978 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

AZL-100274 CVE-2026-80977 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80988

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 "ntb: Drop packets when qp link is down" meant to make ntbtransporttxenqueue drop packets submitted while the QP link is down, but it only returns 0...

CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

UBUNTU-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

UBUNTU-CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

UBUNTU-CVE-2026-89564

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

UBUNTU-CVE-2026-80987

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Reject oversized TX buffers ntbprocesstx handles an oversized buffer by calling txhandler with a NULL data pointer and returning success. ntbnetdev therefore neither frees the skb in its completion callback nor...

UBUNTU-CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

UBUNTU-CVE-2026-80988

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 "ntb: Drop packets when qp link is down" meant to make ntbtransporttxenqueue drop packets submitted while the QP link is down, but it only returns 0...

AZL-100709 CVE-2026-80941 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

DEBIAN-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

UBUNTU-CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-80941

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-89565 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89565

In the Linux kernel , the ipip and mplsip tunnel drivers leak a socket buffer (skb) in collect_md mode when ip_tun_rx_dst() fails to allocate a metadata_dst struct via atomic allocation. The function ipip_tunnel_rcv() returns 0 without freeing the skb, and the callers (tunnel4_rcv() / tunnelmpls4...