Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- InfiniBand drivers;
- Network drivers;
- TCM subsystem;
- B.A.T.M.A.N. meshing protocol;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- Netfilter;
- RDS protocol;
(CVE-2026-53131, CVE-2026-53186, CVE-2026-53216, CVE-2026-53221,
CVE-2026-53355, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888,
CVE-2026-63912, CVE-2026-63922, CVE-2026-63924, CVE-2026-63984,
CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64000,
CVE-2026-64007, CVE-2026-64091)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia-6.8 | 6.8.0-1063.66~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-nvidia | 6.8.0-1063.66 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-nvidia-lowlatency | 6.8.0-1063.66.1 |
Vulnerabilities 18
-
Critical 9.8
net: mvpp2: limit XDP frame size to the RX buffer
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff…
-
Critical 9.8
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matc…
-
Critical 9.8
net: rds: clear i_sends on setup unwind
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to disting…
-
Critical 9.8
scsi: target: iscsi: Validate CHAP_R length before base64 decode
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…
-
Critical 9.8
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_…
-
Critical 9.8
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…
-
Critical 9.8
xfrm: esp: restore combined single-frag length gate
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The h…
-
Critical 9.8
ipv6: exthdrs: refresh nh after handling HAO option
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…
-
Critical 9.8
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…
-
Critical 9.8
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…
-
Critical 9.8
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instea…
-
Critical 9.8
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…
-
Critical 9.8
net: hsr: fix potential OOB access in supervision frame handling
In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Wi…
-
Critical 9.8
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…
-
Critical 9.8
batman-adv: tt: fix TOCTOU race for reported vlans
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct s…
-
Critical 9.4
netfilter: require Ethernet MAC header before using eth_hdr()
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…
-
Critical 9.1
RDMA/srp: bound SRP_RSP sense copy by the received length
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP …
-
Critical 9.1
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…
References
-
report
https://ubuntu.com/security/CVE-2026-53131
-
report
https://ubuntu.com/security/CVE-2026-53186
-
report
https://ubuntu.com/security/CVE-2026-53216
-
report
https://ubuntu.com/security/CVE-2026-53221
-
report
https://ubuntu.com/security/CVE-2026-53355
-
report
https://ubuntu.com/security/CVE-2026-63886
-
report
https://ubuntu.com/security/CVE-2026-63887
-
report
https://ubuntu.com/security/CVE-2026-63888
-
report
https://ubuntu.com/security/CVE-2026-63912
-
report
https://ubuntu.com/security/CVE-2026-63922
-
report
https://ubuntu.com/security/CVE-2026-63924
-
report
https://ubuntu.com/security/CVE-2026-63984
-
report
https://ubuntu.com/security/CVE-2026-63992
-
report
https://ubuntu.com/security/CVE-2026-63993
-
report
https://ubuntu.com/security/CVE-2026-63994
-
report
https://ubuntu.com/security/CVE-2026-64000
-
report
https://ubuntu.com/security/CVE-2026-64007
-
report
https://ubuntu.com/security/CVE-2026-64091