CVE-2026-98102

The Linux kernel contains a vulnerability in the ipv6 multicast implementation within the ip6_mc_del1_src() function. When a source filter's count reaches zero, the code incorrectly moves the filter directly into the tombstone list by mutating psf->sf_next before an RCU grace period elapses. B...

CVE-2026-98102 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

CVE-2026-98103

The Linux kernel is affected by a vulnerability where a previous fix to prevent a use-after-free condition in the igmp component introduced a lockdep recursive locking warning or deadlock . Specifically, the ip_check_mc_rcu() function attempted to acquire &im->lock while &pmc->lock was alre...

EUVD-2026-86933

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

CVE-2026-98103

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

CVE-2026-98103 igmp: convert struct ip_sf_list to RCU

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

CVE-2026-98101

The Linux kernel contains a vulnerability in the ipv6 multicast implementation where the pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in UDP and RAW multicast receive paths. The root cause is that ip6_mc_source() performs in-place mutation of...

EUVD-2026-86932

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2026-98101 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2026-98101 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2019-13272

CVE-2019-13272 CVE-2019-13272 のエクスプロイト 脆弱性タイプ：Linux ローカル権限昇格 脆弱性の影響範囲：Linuxカーネルバージョン 5.1.17 未満 ローカルテスト環境： 脆弱性関連情報： https://bugs.chromium.org/p/project-zero/issues/detail?id=1903...

krie

KRIe KRIe는 eBPF를 사용하여 Linux 커널 익스플로잇을 탐지하는 것을 목표로 하는 연구 프로젝트입니다. KRIe는 완벽한 방어 전략과는 거리가 멉니다. eBPF 관련 제한 사항부터, 보안 이벤트를 방출하기 위해 손상된 커널에 의존할 수 있는 사후 탐지까지, 동기 부여된 공격자는 결국 이를 우회할 수 있을 것이 분명합니다. 그럼에도 불구하고 이 프로젝트의 목표는 공격자들의 삶을 더 어렵게 만들고, 궁극적으로 취약한 커널에서 즉시 사용 가능한 익스플로잇이 작동하는 것을 방지하는 것입니다. KRIe는 다양한 커널 버전과...

CVE-2026-98099

The Linux kernel contains a vulnerability in the net/ipv6/mcast.c component where RCU-protected lists (specifically np->ipv6_mc_list , idev->mc_list , and idev->mc_tomb ) are updated using direct pointer assignments instead of the required rcu_assign_pointer() function. This occurs in fu...

CVE-2026-98098 tipc: fix NULL deref in tipc_named_node_up() on empty publication list

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

EUVD-2026-86928

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

EUVD-2026-86929

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98098

A NULL pointer dereference exists in the Linux kernel 's TIPC (Transparent Inter-Process Communication) protocol. The vulnerability occurs in tipc_named_node_up() when the number of local publications exceeds TIPC_MAX_PUBL (65535). Under these conditions, protocol service types are not inserted i...

CVE-2026-98096

The Linux kernel contains a vulnerability in its IPv6 Segment Routing (SR) handling. The ipv6_srh_rcv() function incorrectly calculates the skb->data position by assuming the SRH immediately follows the fixed IPv6 header. If a preceding extension header (e.g., Hop-by-Hop options ) exists, skb_...