CVE-2026-68476

CriticalCVSS 9.8/10Last modified Sep 2, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reload ip header after head reallocation

__ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Sep 2, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-684779.8In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reportCVE-2026-68478In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftlCVE-2026-684797.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware(CVE-2026-68488.1A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or CVE-2026-68480In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attackerCVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports CVE-2026-68482Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorizeCVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verifyCVE-2026-684879.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-684889.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to rootCVE-2026-684898.7Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to executCVE-2026-68498.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo
CVE-2026-68476: Critical severity, CVSS 9.8 | Vulnix