CVE-2026-98241

The Linux kernel contains a vulnerability where the xfrm6_local_rxpmtu() and xfrm6_local_error() functions incorrectly dereference skb->sk as a full IPv6 socket. This occurs because TCP SYN-ACK skbs may be owned by a TCP_NEW_SYN_RECV request_sock while the output path is driven by a full liste...

EUVD-2026-93169

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...