ipxe

iPXE network bootloader iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as: boot from a web server via HTTP or HTTPS, boot from an iSCSI, FCoE, or AoE SAN, control the boot process with a script, create interactiv...

kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone passes each received PDU to the opcode handlers without ever checking wc-bytelen, which represents the actual number of bytes the HCA placed into the recei...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with transportkmapdatasg and parses the destination TransportID using...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove pass the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without it how...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU’s BHS declares...

kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...

kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...

kernel security update

4.18.0-553.182.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Oracle Linux 8 : kernel (ELSA-2026-93414)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-93414 advisory. - ipv4: free inetopt and ireqopt after an RCU grace period Davide Caratti RHEL-295615 CVE-2026-98432 - smb: client: bound dirent name against end of SMB respon...

kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload

A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol CHAP. This can lead to an out-of-bounds read,...

kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...

kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload

A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol CHAP. This can lead to an out-of-bounds read,...

CVE-2026-99154

A flaw was found in the Linux kernel's libiscsi module. A remote iSCSI target can trigger an out-of-bounds memory read by sending a crafted Protocol Data Unit PDU containing a negative task index. This flaw can cause a kernel crash, resulting in a Denial of Service DoS, or potentially lead to...

CVE-2026-99152

A flaw was found in the Linux kernel's SCSI iSCSI implementation libiscsi. A remote, connected iSCSI target can cause a Denial of Service DoS by sending a crafted management response that references an uninitialized or free task slot. Because the kernel fails to verify that the task is active...

advisories

LinnemanLabs Research and Advisories Security research, advisories, and proof-of-concept code from LinnemanLabs. Advisories and Research Links to write-ups, disclosures, and reproducible PoCs. Project| Findings / Techniques| CVEs| Result| Write-up| PoC ---|---|---|---|---|--- bluez| ?| ?| LPE to...

RXSA-2026:92209 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling CVE-2026-72288 kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...