PT-2026-81205

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc3 Description An out-of-bounds write occurs in the net defragment function within net/net.c when CONFIG IP DEFRAG is enabled. Remote attackers can trigger this by sending a crafted IP fragment with a non-zero...

PT-2026-81199

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211 michael mic failure function within sys/net80211/ieee80211 crypto tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated b...

PT-2026-81214

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6 parse options that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

PT-2026-81207

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs read directory table function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablks count value that causes heap buffer under-allocation...