CVE-2026-68476

CriticalCVSS 9.8/10Last modified Sep 2, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reload ip header after head reallocation

__ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < 4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < 657118cad620172dfd8f6ed5717fd75c0d1f7a5a; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < a10f5080afbed242640f2984328de25f84557da1; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < ac6ac3d35bfc0ade9d17d354c84e503a946ebdab; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < e51687fc56c2e39ea6e9532925f1aabd4d529f61; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < 3fb7edd2018bb1ad0a68157383d9b9dac33dd645; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < ad1e14710b360bda087ebf9fb82460eb5ef775de; >= 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49, < a2f57827bf7c695b8c72dc4511cae8e86582369d
Linux	Linux	4.10

References

Timeline

Published: Aug 15, 2026
Last modified: Sep 2, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-684779.8In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko report CVE-2026-68478In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftl CVE-2026-684797.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware(CVE-2026-68488.1A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or CVE-2026-68480In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker CVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports CVE-2026-684825.3Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorize CVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify CVE-2026-684854.3An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency t CVE-2026-684865.4An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with CVE-2026-684879.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-684889.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root