CVE-2026-45850

ipvs: skip ipv6 extension headers for csum checks

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since May 28, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: CVE-2026-45850
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

CVE List No score

ipvs: skip ipv6 extension headers for csum checks

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: CVE-2026-45850
Updated: 2026-11-06

EUVDEUVD-2026-32316 No score

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: EUVD-2026-32316
Updated: 2026-11-06

GitHub AdvisoriesGHSA-3j9q-258h-4v38 5.5

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension...

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: GHSA-3j9q-258h-4v38
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-45850 5.5

Record: BELL-CVE-2026-45850
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-45850 5.5

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: DEBIAN-CVE-2026-45850
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-07

Show 25 moreShow less

OSVOESA-2026-2675 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Fix timeline left held on VMA alloc error

The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform:

<4> [239.330153] ------------[ cut here ]------------ <4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count) <4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330942] Call Trace: <4> [239.330944] <TASK> <4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] <4> [239.331202] i915_driver_release+0x86/0xa0 [i915] <4> [239.331482] devm_drm_dev_init_release+0x61/0x90 <4> [239.331494] devm_action_release+0x15/0x30 <4> [239.331504] release_nodes+0x3d/0x120 <4> [239.331517] devres_release_all+0x96/0xd0 <4> [239.331533] device_unbind_cleanup+0x12/0x80 <4> [239.331543] device_release_driver_internal+0x23a/0x280 <4> [239.331550] ? bus_find_device+0xa5/0xe0 <4> [239.331563] device_driver_detach+0x14/0x20 ... <4> [357.719679] ---[ end trace 0000000000000000 ]---

If the test also unloads the i915 module then that's followed with:

<3> [357.787478] ============================================================================= <3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() <3> [357.788031] ----------------------------------------------------------------------------- <3> [357.788204] Object 0xffff888109e7f480 @offset=29824 <3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 <4> [357.788994] i915_vma_instance+0xee/0xc10 [i915] <4> [357.789290] init_status_page+0x7b/0x420 [i915] <4> [357.789532] intel_engines_init+0x1d8/0x980 [i915] <4> [357.789772] intel_gt_init+0x175/0x450 [i915] <4> [357.790014] i915_gem_init+0x113/0x340 [i915] <4> [357.790281] i915_driver_probe+0x847/0xed0 [i915] <4> [357.790504] i915_pci_probe+0xe6/0x220 [i915] ...

Closer analysis of CI results history has revealed a dependency of the error on a few IGT tests, namely:

igt@api_intel_allocator@fork-simple-stress-signal,
igt@api_intel_allocator@two-level-inception-interruptible,
igt@gem_linear_blits@interruptible,
igt@prime_mmap_coherency@ioctl-errors, which invisibly trigger the issue, then exhibited with first driver unbind attempt.

All of the above tests perform actions which are actively interrupted with signals. Further debugging has allowed to narrow that scope down to DRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring submission, in particular.

If successful then that function, or its execlists or GuC submission equivalent, is supposed to be called only once per GEM context engine, followed by raise of a flag that prevents the function from being called again. The function is expected to unwind its internal errors itself, so it may be safely called once more after it returns an error.

In case of ring submission, the function first gets a reference to the engine's legacy timeline and then allocates a VMA. If the VMA allocation fails, e.g. when i915_vma_instance() called from inside is interrupted with a signal, then ring_context_alloc() fails, leaving the timeline held referenced. On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the timeline is got, and only that last one is put on successful completion. As a consequence, the legacy timeline, with its underlying engine status page's VMA object, is still held and not released on driver unbind.

Get the legacy timeline only after successful allocation of the…

Record: OESA-2026-2675
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-2676 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

parisc: Drop WARN_ON_ONCE() from flush_cache_vmap

I have observed warning to occassionally trigger.(CVE-2025-39781)

In the Linux kernel, the following vulnerability has been resolved:

MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section.

This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot.

This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel.(CVE-2025-71109)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Disable MMIO access during SMU Mode 1 reset

During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this window (e.g., from interrupt handlers or other driver threads) can result in uncompleted PCIe transactions, leading to NMI panics or system hangs.

To prevent this, set the no_hw_access flag to true immediately after triggering the reset. This signals other driver components to skip register accesses while the device is offline.

A memory barrier smp_mb() is added to ensure the flag update is globally visible to all cores before the driver enters the sleep/wait state.

(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)(CVE-2026-23213)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: reject new transactions if the fs is fully read-only

[BUG] There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount:

BTRFS: Transaction aborted (error -22) Modules linked in: CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted 6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:find_free_extent_update_loop fs/btrfs/extent-tree.c:4208 [inline] RIP: 0010:find_free_extent+0x52f0/0x5d20 fs/btrfs/extent-tree.c:4611 Call Trace: <TASK> btrfs_reserve_extent+0x2cd/0x790 fs/btrfs/extent-tree.c:4705 btrfs_alloc_tree_block+0x1e1/0x10e0 fs/btrfs/extent-tree.c:5157 btrfs_force_cow_block+0x578/0x2410 fs/btrfs/ctree.c:517 btrfs_cow_block+0x3c4/0xa80 fs/btrfs/ctree.c:708 btrfs_search_slot+0xcad/0x2b50 fs/btrfs/ctree.c:2130 btrfs_truncate_inode_items+0x45d/0x2350 fs/btrfs/inode-item.c:499 btrfs_evict_inode+0x923/0xe70 fs/btrfs/inode.c:5628 evict+0x5f4/0xae0 fs/inode.c:837 __dentry_kill+0x209/0x660 fs/dcache.c:670 finish_dput+0xc9/0x480 fs/dcache.c:879 shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1661 generic_shutdown_super+0x67/0x2c0 fs/super.c:621 kill_anon_super+0x3b/0x70 fs/super.c:1289 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2127 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318 task_work_run+0x1d4/0x260 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] …

Record: OESA-2026-2676
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-45850 8.8

Record: UBUNTU-CVE-2026-45850
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-88443 No score

CVE-2026-45850 affecting package kernel for versions less than 6.6.143.1-1

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: AZL-88443
Updated: 2026-11-02

OSVCLSA-2026-1787935638 No score

kernel: Fix of 164 CVEs

wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
nvme-tcp: sanitize request list handling {CVE-2025-38264}
smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
nfsd: never defer requests during idmap lookup {CVE-2026-45983}
openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
smb: client: fix krb5 mount with username option {CVE-2026-31392}
netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
RDMA/vmw_pvrdma: Fix…

Record: CLSA-2026-1787935638
Updated: 2026-11-02

OSVCLSA-2026-1788168285 No score

kernel: Fix of 193 CVEs

mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
nfsd: never defer requests during idmap lookup {CVE-2026-45983}
drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
ipc: limit next_id…

Record: CLSA-2026-1788168285
Updated: 2026-11-02

OSV No score

ipvs: skip ipv6 extension headers for csum checks

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks

Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem.

Record: CVE-2026-45850
Updated: 2026-11-07

OSVROOT-OS-DEBIAN-11-CVE-2026-45850 No score

CVE-2026-45850 in linux - Patched by Root

Root has patched CVE-2026-45850 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-45850
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-45850 No score

CVE-2026-45850 in linux - Patched by Root

Root has patched CVE-2026-45850 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-45850
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-45850 No score

CVE-2026-45850 in linux - Patched by Root

Root has patched CVE-2026-45850 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-45850
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-45850 No score

CVE-2026-45850 in linux - Patched by Root

Root has patched CVE-2026-45850 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-45850
Updated: 2026-11-06

OSVUSN-8781-1 No score

linux-nvidia-tegra vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)