Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Incorrect buffer length calculation in Linux kernel ksmbd SMB server (CVE-2026-31478)
The Linux kernel's ksmbd SMB server daemon contains an incorrect buffer length calculation in `smb2_calc_max_out_buf_len()`, where hardcoded magic numbers are used in place of the correct `offsetof()` value for the re...
Fixed in linux-image-6.17.0-1018-oracle 6.17.0-1018.18; linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18; linux-image-6.17.0-1019-aws 6.17.0-1019.19; linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19; linux-image-6.17.0-1020-gcp 6.17.0-1020.22; linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22; linux-image-6.17.0-40-generic 6.17.0-40.40; linux-image-6.17.0-40-generic-64k 6.17.0-40.40
Use-after-free in Linux kernel TLS encryption error path (CVE-2026-31533)
A use-after-free vulnerability exists in the Linux kernel's TLS subsystem in the -EBUSY error path of tls_do_encryption(). When a crypto request is enqueued to the cryptd backlog and returns -EBUSY, both the async cal...
Fixed in linux-image-5.4.0-1077-xilinx-zynqmp 5.4.0-1077.81; linux-image-5.4.0-1105-ibm 5.4.0-1105.110; linux-image-5.4.0-1118-bluefield 5.4.0-1118.125; linux-image-5.4.0-1133-fips 5.4.0-1133.143; linux-image-5.4.0-1146-kvm 5.4.0-1146.155
Heap buffer overflow in Linux kernel batman-adv TT response handling (CVE-2026-31659)
The batman-adv subsystem in the Linux kernel computes the allocation length for a global translation table (TT) response using 16-bit temporaries. A remote originator advertising a sufficiently large global TT can cau...
Fixed in 6.17.0-1018.18; 6.17.0-1019.19; 6.17.0-1020.22; 6.17.0-40.40
Routing cache isolation flaw in Linux kernel seg6 lwtunnel (CVE-2026-31668)
The seg6 lwtunnel in the Linux kernel shares a single dst_cache between the seg6_input_core() and seg6_output_core() paths. Because these paths can perform post-encapsulation SID lookups under different routing contex...
Fixed in linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18; linux-image-6.17.0-1019-aws 6.17.0-1019.19; linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19; linux-image-6.17.0-1020-gcp 6.17.0-1020.22; linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22; linux-image-6.17.0-40-generic 6.17.0-40.40
Invalid MAC header access in Linux kernel netfilter ip6t_eui64 (CVE-2026-31685)
In the Linux kernel netfilter subsystem, the `eui64_mt6()` function in `ip6t_eui64` fails to reject packets with an invalid MAC header when `par->fragoff == 0`, allowing the code to reach `eth_hdr(skb)` without a vali...
Fixed in linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18; linux-image-6.17.0-1019-aws 6.17.0-1019.19; linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19; linux-image-6.17.0-1020-gcp 6.17.0-1020.22; linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22; linux-image-6.17.0-40-generic 6.17.0-40.40
Heap buffer overflow in Linux kernel IPv6 UDP stack (CVE-2026-53362)
CVE-2026-53362 is a Linux kernel heap buffer overflow in `__ip6_append_data()` caused by incorrect accounting of `fraggap` bytes on the paged allocation path, resulting in writes past `skb->end` into the trailing `skb...
Fixed in 6.12.95