EUVD-2026-86933

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

CVE-2026-98103

The Linux kernel is affected by a vulnerability where a previous fix to prevent a use-after-free condition in the igmp component introduced a lockdep recursive locking warning or deadlock . Specifically, the ip_check_mc_rcu() function attempted to acquire &im->lock while &pmc->lock was alre...

CVE-2026-98103

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

CVE-2026-98101

The Linux kernel contains a vulnerability in the ipv6 multicast implementation where the pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in UDP and RAW multicast receive paths. The root cause is that ip6_mc_source() performs in-place mutation of...

EUVD-2026-86932

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2026-98101 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2019-13272

CVE-2019-13272 CVE-2019-13272 のエクスプロイト 脆弱性タイプ：Linux ローカル権限昇格 脆弱性の影響範囲：Linuxカーネルバージョン 5.1.17 未満 ローカルテスト環境： 脆弱性関連情報： https://bugs.chromium.org/p/project-zero/issues/detail?id=1903...

krie

KRIe KRIe는 eBPF를 사용하여 Linux 커널 익스플로잇을 탐지하는 것을 목표로 하는 연구 프로젝트입니다. KRIe는 완벽한 방어 전략과는 거리가 멉니다. eBPF 관련 제한 사항부터, 보안 이벤트를 방출하기 위해 손상된 커널에 의존할 수 있는 사후 탐지까지, 동기 부여된 공격자는 결국 이를 우회할 수 있을 것이 분명합니다. 그럼에도 불구하고 이 프로젝트의 목표는 공격자들의 삶을 더 어렵게 만들고, 궁극적으로 취약한 커널에서 즉시 사용 가능한 익스플로잇이 작동하는 것을 방지하는 것입니다. KRIe는 다양한 커널 버전과...

wifi-framework

Wi-Fi 프레임워크 Wi-Fi 실험을 더 쉽게 수행할 수 있는 프레임워크를 제시합니다. 퍼저를 만들고, 새로운 공격을 구현하고, 취약점을 테스트하기 위한 개념 증명을 만들고, 실험을 자동화하고, 테스트 스위트를 구현하는 등에 사용할 수 있습니다. 프레임워크의 주요 장점은 리눅스의 Wi-Fi 기능을 재사용하여 공격 및/또는 테스트를 더 쉽게 구현할 수 있다 는 점입니다. 예를 들어, 프레임워크는 보호된 Wi-Fi 네트워크에 연결하고 클라이언트를 테스트할 때 비콘을 브로드캐스트할 수 있습니다. 일반적으로 리눅스의 모든 Wi-Fi...

CVE-2026-98099

The Linux kernel contains a vulnerability in the net/ipv6/mcast.c component where RCU-protected lists (specifically np->ipv6_mc_list , idev->mc_list , and idev->mc_tomb ) are updated using direct pointer assignments instead of the required rcu_assign_pointer() function. This occurs in fu...

EUVD-2026-86928

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98098

A NULL pointer dereference exists in the Linux kernel 's TIPC (Transparent Inter-Process Communication) protocol. The vulnerability occurs in tipc_named_node_up() when the number of local publications exceeds TIPC_MAX_PUBL (65535). Under these conditions, protocol service types are not inserted i...

CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

EUVD-2026-86929

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

EUVD-2026-86927

In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length TIPCMAXIFNAME buffer. Replace the strcpydata, l-ifname with memcpy so that the pad bytes are actually written l-ifname is...

CVE-2026-98096

The Linux kernel contains a vulnerability in its IPv6 Segment Routing (SR) handling. The ipv6_srh_rcv() function incorrectly calculates the skb->data position by assuming the SRH immediately follows the fixed IPv6 header. If a preceding extension header (e.g., Hop-by-Hop options ) exists, skb_...

EUVD-2026-86926

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-98096 ipv6: sr: restore network header before routing and forwarding

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-98097

The Linux kernel contains a vulnerability in the tipc component where RESET/ACTIVATE messages could transmit random pad bytes to a remote system. This occurs because the interface name is passed in a fixed-length buffer using strcpy(), which fails to properly zero-pad the remaining bytes. The iss...

CVE-2026-98095 af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader. syzbot reported BUG in socksendmsgnosec. 0 The problem is that tpacketparseheader casts user-provided tpackethdr.tplen, which is u32, to int. If the length is...