CVE-2026-68297 (GCVE-0-2026-68297)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-19 16:32
VLAI
Title
tipc: fix u16 MTU truncation in media and bearer MTU validation
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors. Crash stack (triggered as unprivileged user via user namespace): tipc_link_set_queue_limits net/tipc/link.c:2531 tipc_link_create net/tipc/link.c:520 tipc_node_check_dest net/tipc/node.c:1279 tipc_disc_rcv net/tipc/discover.c:252 tipc_rcv net/tipc/node.c:2129 tipc_udp_recv net/tipc/udp_media.c:392 Two independent paths lack the upper bound check: 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET) Fix both by rejecting MTU values above U16_MAX.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < 8bfdfe0dbb36a650b7c4dec1aeae078319938a0b (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < dc4b577a083b361d25e118dc96d8281255ebe22c (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < dfdfd987f1917c84766e097a6120a1f3f1634940 (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < f02334a9e378f7e07232b26dc3d2ab353339f040 (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < f4013598b69457dbea350df52e52daea6faef8eb (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < 1b8fb5a20508bfb0db854e01214888c761b3a911 (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < c1cda72f6acec02ebd45d913bf8527ff77336ba6 (git)
Affected: 901271e0403af638c224987c2a4e55cebade7e91 , < 9f29cd8a8e7901a2617c8064ce9f50fc67b97cb8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bfdfe0dbb36a650b7c4dec1aeae078319938a0b",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "dc4b577a083b361d25e118dc96d8281255ebe22c",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "dfdfd987f1917c84766e097a6120a1f3f1634940",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "f02334a9e378f7e07232b26dc3d2ab353339f040",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "f4013598b69457dbea350df52e52daea6faef8eb",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "1b8fb5a20508bfb0db854e01214888c761b3a911",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "c1cda72f6acec02ebd45d913bf8527ff77336ba6",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            },
            {
              "lessThan": "9f29cd8a8e7901a2617c8064ce9f50fc67b97cb8",
              "status": "affected",
              "version": "901271e0403af638c224987c2a4e55cebade7e91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix u16 MTU truncation in media and bearer MTU validation\n\nBoth TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied\nMTU values but only enforce a minimum bound, not a maximum. When a user\nsets the MTU to a value exceeding U16_MAX (65535), it passes validation\nbut is silently truncated when assigned to u16 fields l-\u003emtu and\nl-\u003eadvertised_mtu in tipc_link_create(). Values like 65536 (0x10000)\ntruncate to 0, causing a division by zero in tipc_link_set_queue_limits()\nwhich computes TIPC_MAX_PUBL / (l-\u003emtu / ITEM_SIZE). Other overflowing\nvalues (e.g. 65537-131071) produce small incorrect MTU values, resulting\nin link malfunction behaviors.\n\nCrash stack (triggered as unprivileged user via user namespace):\n\n  tipc_link_set_queue_limits  net/tipc/link.c:2531\n  tipc_link_create            net/tipc/link.c:520\n  tipc_node_check_dest        net/tipc/node.c:1279\n  tipc_disc_rcv               net/tipc/discover.c:252\n  tipc_rcv                    net/tipc/node.c:2129\n  tipc_udp_recv               net/tipc/udp_media.c:392\n\nTwo independent paths lack the upper bound check:\n1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)\n2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)\n\nFix both by rejecting MTU values above U16_MAX."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack begins with a local TIPC netlink command (TIPC_NL_BEARER_SET/TIPC_NL_MEDIA_SET) setting an out-of-range MTU, with the crash/corruption then triggered by locally generated discovery traffic and sendmsg() in the attacker\u0027s own network namespace.\nAC:L - The attacker fully controls both the bad MTU value and the discovery packet that creates the link, so the truncation and subsequent divide-by-zero or undersized-fragment path trigger deterministically on every attempt.\nPR:L - Both netlink ops are gated by GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the owning user namespace, which any unprivileged user obtains via `unshare -Urn`; the commit message explicitly reports the crash reproduced as an unprivileged user through a user namespace.\nUI:N - The attacker performs every step (bearer setup, MTU configuration, packet injection, sendmsg) with no action from any other user or administrator.\nS:U - The truncated MTU corrupts only kernel state within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Truncated MTUs below the TIPC header size propagate into tipc_msg_build() as pktmax, driving negative fragment remainders and oversized copies into undersized skbs; the resulting heap corruption and adjacent-object exposure can be leveraged to read kernel memory.\nI:H - The undersized-fragment path writes INT_H_SIZE plus header bytes and then a negative-length (huge unsigned) user copy into a buffer allocated at the truncated MTU size, giving an attacker-controlled linear heap overflow suitable for control-flow hijacking.\nA:H - MTU values truncating to under 20 make tipc_link_set_queue_limits() divide by zero inside tipc_link_create(), which runs in softirq context from tipc_udp_recv()/tipc_disc_rcv(), producing a kernel oops that is typically fatal in interrupt context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:32:46.091Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bfdfe0dbb36a650b7c4dec1aeae078319938a0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc4b577a083b361d25e118dc96d8281255ebe22c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfdfd987f1917c84766e097a6120a1f3f1634940"
        },
        {
          "url": "https://git.kernel.org/stable/c/f02334a9e378f7e07232b26dc3d2ab353339f040"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4013598b69457dbea350df52e52daea6faef8eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b8fb5a20508bfb0db854e01214888c761b3a911"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1cda72f6acec02ebd45d913bf8527ff77336ba6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f29cd8a8e7901a2617c8064ce9f50fc67b97cb8"
        }
      ],
      "title": "tipc: fix u16 MTU truncation in media and bearer MTU validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68297",
    "datePublished": "2026-08-10T12:02:30.721Z",
    "dateReserved": "2026-07-30T09:28:09.380Z",
    "dateUpdated": "2026-08-19T16:32:46.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68297",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02905"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/netlink.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8bfdfe0dbb36a650b7c4dec1aeae078319938a0b",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc4b577a083b361d25e118dc96d8281255ebe22c",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dfdfd987f1917c84766e097a6120a1f3f1634940",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f02334a9e378f7e07232b26dc3d2ab353339f040",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4013598b69457dbea350df52e52daea6faef8eb",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b8fb5a20508bfb0db854e01214888c761b3a911",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1cda72f6acec02ebd45d913bf8527ff77336ba6",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f29cd8a8e7901a2617c8064ce9f50fc67b97cb8",
                    "status": "affected",
                    "version": "901271e0403af638c224987c2a4e55cebade7e91",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/netlink.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix u16 MTU truncation in media and bearer MTU validation\n\nBoth TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied\nMTU values but only enforce a minimum bound, not a maximum. When a user\nsets the MTU to a value exceeding U16_MAX (65535), it passes validation\nbut is silently truncated when assigned to u16 fields l-\u003emtu and\nl-\u003eadvertised_mtu in tipc_link_create(). Values like 65536 (0x10000)\ntruncate to 0, causing a division by zero in tipc_link_set_queue_limits()\nwhich computes TIPC_MAX_PUBL / (l-\u003emtu / ITEM_SIZE). Other overflowing\nvalues (e.g. 65537-131071) produce small incorrect MTU values, resulting\nin link malfunction behaviors.\n\nCrash stack (triggered as unprivileged user via user namespace):\n\n  tipc_link_set_queue_limits  net/tipc/link.c:2531\n  tipc_link_create            net/tipc/link.c:520\n  tipc_node_check_dest        net/tipc/node.c:1279\n  tipc_disc_rcv               net/tipc/discover.c:252\n  tipc_rcv                    net/tipc/node.c:2129\n  tipc_udp_recv               net/tipc/udp_media.c:392\n\nTwo independent paths lack the upper bound check:\n1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)\n2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)\n\nFix both by rejecting MTU values above U16_MAX."
          }
        ],
        "id": "CVE-2026-68297",
        "lastModified": "2026-08-19T17:20:40.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:19.173",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b8fb5a20508bfb0db854e01214888c761b3a911"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8bfdfe0dbb36a650b7c4dec1aeae078319938a0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f29cd8a8e7901a2617c8064ce9f50fc67b97cb8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c1cda72f6acec02ebd45d913bf8527ff77336ba6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc4b577a083b361d25e118dc96d8281255ebe22c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfdfd987f1917c84766e097a6120a1f3f1634940"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f02334a9e378f7e07232b26dc3d2ab353339f040"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4013598b69457dbea350df52e52daea6faef8eb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:14:27+00:00",
      "cve": "CVE-2026-68297",
      "id": "CVE-2026-68297",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: fix u16 MTU truncation in media and bearer MTU validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68297.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:32:33Z",
      "cve": "CVE-2026-68297",
      "id": "CVE-2026-68297",
      "initial_release_date": "2026-08-14T17:14:29Z",
      "product_status:known_affected": "634",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68297",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68297.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.