CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

TUNderflow

TUNderflow CVE-2026-81000 Writeuphttps://heyitsas.im/pos...

ROS-20260918-73-0043

The vulnerability of the validateset function in the netopenvswitch/flownetlink.c module, which supports Open vSwitch routers in Linux operating systems, relates to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the...

SUSE CVE-2026-90049

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

AZL-101409 CVE-2026-90049 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

DEBIAN-CVE-2026-90049

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90049

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

EUVD-2026-80657

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...