AppleDOS

AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...

uefi-pxe-cve-2026-97631

uefi-pxe-cve-2026-97631 — headless harness for the EDK II PXE ICMP overflow ⚠️ LOCAL LAB ONLY. These tools drive a local QEMU VM against a firmware you control. Never point the ICMP generator at hardware or networks you don't own. CVE-2026-97631: a 16-year-old buffer overflow in TianoCore EDK II...

Bootjack

CVE-2026-97631: pre-boot DXE memory reader Tooling for the EDK II PXE Base Code driver ICMP error overflow NetworkPkg/UefiPxeBcDxe, GHSA-99cj-7hg9-mp4m, CVSS 4.0 9.5. During a PXE boot the driver copies an ICMP error message into a fixed 504-byte buffer. A longer message becomes a linear write pa...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 is a buffer overflow vulnerability in the XNU kernel's ICMP error code. It causes IOS devices to crash both laptops and mobiles upon receival of one yes 1! single bad packet. The bug was originally disclosured by Kevin Backhouse on his lgtm blogpost on October 30th 201...

Exploit for CVE-2026-97631

PXE Zero Working lab exploit and business pack for CVE-2026-9...

Exploit for CVE-2026-97631

uefi-pxe-cve-2026-97631 — headless harness for the EDK II PXE...

SUSE CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

DEBIAN-CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

UBUNTU-CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

EUVD-2026-108825

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030

The Linux kernel contains a vulnerability in the skb_copy_and_csum_bits() function where unreadable fragments cause the function to return 0 after only copying the linear part. This leaves stale bytes in the caller's buffer, which is then sent over the wire as part of an ICMP error quote or a dri...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tunnels: Fixed the crash when generating IPV4 PMTU errors due to KASAN. If we attempt to emit an ICMP error in response to a non-linear SKB, we encounter the following issue: Bug: KASAN: Out-of-bounds access in...

Astra Linux – Vulnerability in OVN

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header’s self-declared total length iptotlen for IPv4, ip6plen for IPv6, without validating it against the actual packet buffer siz...

CVE-2026-74597

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 tunnel error handling. A remote attacker could send a specially crafted IPv6 ICMP Internet Control Message Protocol error packet with a malformed inner destination-options header. This could lead to memory corruption within t...

CVE-2026-74669

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

CVE-2026-72319

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. This vulnerability occurs when the system processes Internet Control Message Protocol ICMP errors originating from network tunnels. Specifically, after stripping outer packet headers, the IPVS component fails to ensure that...