ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 22
ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 22
CVE-2026-31415
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-14...
CVE-2026-31415
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-14...
CVE-2026-31415
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom
CVE-2026-31415
In the Linux kernel, the following vulnerability has been resolved: i ...
GHSA-2rf4-5672-vqwm
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headr...
BDU:2026-12271
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΡΠ½ΠΊΡΠΈΠΈ ip6_datagram_send_ctl() ΠΌΠΎΠ΄ΡΠ»Ρ net/ipv6/datagram.c ΡΠ΅Π°Π»ΠΈΠ·Π°ΡΠΈΠΈ ΠΏΡΠΎΡΠΎΠΊΠΎΠ»Π° IPv6 ΡΠ΄ΡΠ° ΠΎΠΏΠ΅ΡΠ°ΡΠΈΠΎΠ½Π½ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΡ Linux, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ
ROS-20261006-80-0344
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ kernel-lt
ROS-20261006-73-0342
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ kernel-lt
SUSE-SU-2026:2450-1
Security update for the Linux Kernel
SUSE-SU-2026:2217-1
Security update for the Linux Kernel
SUSE-SU-2026:2238-1
Security update for the Linux Kernel
openSUSE-SU-2026:20826-1
Security update for the Linux Kernel
ALT-PU-2026-6805
ALT-PU-2026-6805: package `kernel-image-un-def` update to version 6.1.168-alt1
ALT-PU-2026-7359
ALT-PU-2026-7359: package `kernel-image-std-def` update to version 5.10.253-alt1
ALT-PU-2026-7109
ALT-PU-2026-7109: package `kernel-image-rt` update to version 5.10.254-alt1.rt150
ALT-PU-2026-6793
ALT-PU-2026-6793: package `kernel-image-6.18` update to version 6.18.22-alt1
ALT-PU-2026-7584
ALT-PU-2026-7584: package `kernel-image-rpi-un` update to version 6.12.86-alt1
ELSA-2026-50372
ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT)
ALT-PU-2026-7350
ALT-PU-2026-7350: package `kernel-image-pine` update to version 6.18.27-alt1
ALT-PU-2026-7006
ALT-PU-2026-7006: package `kernel-image-6.12` update to version 6.12.85-alt1
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ | CVSS | EPSS | ΠΠΏΡΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ | |
|---|---|---|---|---|
 | CVE-2026-31415 In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-14... | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | CVE-2026-31415 In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-14... | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | CVE-2026-31415 In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
| CVE-2026-31415 In the Linux kernel, the following vulnerability has been resolved: i ... | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
| GHSA-2rf4-5672-vqwm In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headr... | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | BDU:2026-12271 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΡΠ½ΠΊΡΠΈΠΈ ip6_datagram_send_ctl() ΠΌΠΎΠ΄ΡΠ»Ρ net/ipv6/datagram.c ΡΠ΅Π°Π»ΠΈΠ·Π°ΡΠΈΠΈ ΠΏΡΠΎΡΠΎΠΊΠΎΠ»Π° IPv6 ΡΠ΄ΡΠ° ΠΎΠΏΠ΅ΡΠ°ΡΠΈΠΎΠ½Π½ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΡ Linux, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 7 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | ROS-20261006-80-0344 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ kernel-lt | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 20 Π΄Π½Π΅ΠΉ Π½Π°Π·Π°Π΄ |
| ROS-20261006-73-0342 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ kernel-lt | CVSS3: 5.5 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 20 Π΄Π½Π΅ΠΉ Π½Π°Π·Π°Π΄ |
 | SUSE-SU-2026:2450-1 Security update for the Linux Kernel | 4 ΠΌΠ΅ΡΡΡΠ° Π½Π°Π·Π°Π΄ | ||
| SUSE-SU-2026:2217-1 Security update for the Linux Kernel | 5 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | ||
| SUSE-SU-2026:2238-1 Security update for the Linux Kernel | 4 ΠΌΠ΅ΡΡΡΠ° Π½Π°Π·Π°Π΄ | ||
| openSUSE-SU-2026:20826-1 Security update for the Linux Kernel | 5 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | ||
| ALT-PU-2026-6805 ALT-PU-2026-6805: package `kernel-image-un-def` update to version 6.1.168-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ALT-PU-2026-7359 ALT-PU-2026-7359: package `kernel-image-std-def` update to version 5.10.253-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ALT-PU-2026-7109 ALT-PU-2026-7109: package `kernel-image-rt` update to version 5.10.254-alt1.rt150 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ALT-PU-2026-6793 ALT-PU-2026-6793: package `kernel-image-6.18` update to version 6.18.22-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ALT-PU-2026-7584 ALT-PU-2026-7584: package `kernel-image-rpi-un` update to version 6.12.86-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ELSA-2026-50372 ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 4 ΠΌΠ΅ΡΡΡΠ° Π½Π°Π·Π°Π΄ | ||
| ALT-PU-2026-7350 ALT-PU-2026-7350: package `kernel-image-pine` update to version 6.18.27-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ | |
| ALT-PU-2026-7006 ALT-PU-2026-7006: package `kernel-image-6.12` update to version 6.12.85-alt1 | CVSS3: 9.8 | 6 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ