CVE-2026-23391High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helpe…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_CT: drop pending enqueued packets on template removal
Templates refer to objects that can go away while packets are sitting in nfqueue refer to:
The use of templates with zone and event cache filter are safe, since this just copies values.
Flush these enqueued packets in case the template rule gets removed.
Linux >= 24de58f465165298aaa8f286b2592f0163706cfe < 55445134d42b84cb0a272e42c98d233ca65eca83Linux >= 24de58f465165298aaa8f286b2592f0163706cfe < cc57506dd66555899560b9c0f24e813f034e12ecLinux >= 24de58f465165298aaa8f286b2592f0163706cfe < d2d0bae0c9a2a17b6990a2966f5cdce0813d6256Linux >= 24de58f465165298aaa8f286b2592f0163706cfe < 63b8097cea1923fe82cd598068d0796da8c015ecLinux >= 24de58f465165298aaa8f286b2592f0163706cfe < 19a230dec6bb8928e3f96387f9085cf2c79bcef9Linux >= 24de58f465165298aaa8f286b2592f0163706cfe < cb549925875fa06dd155e49db4ac2c5044c30f9cLinux >= 24de58f465165298aaa8f286b2592f0163706cfe < 777d02efe3d630cca4c1b63962cec17c57711325Linux >= 24de58f465165298aaa8f286b2592f0163706cfe < f62a218a946b19bb59abdd5361da85fa4606b96bLinux 3.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68286NoneIn the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() /…
CVE-2026-68337NoneIn the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpf_net_context The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri()…
CVE-2026-68287High· 7.5In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attri…
CVE-2026-68288NoneIn the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to a…
CVE-2026-68289NoneIn the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buf…
CVE-2026-68303NoneIn the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions