CVE-2026-31431-cleaned

copyFail.py — CVE Exploit Analysis Report Summary copyFail.py is a proof-of-concept PoC exploit that demonstrates a local privilege escalation vulnerability in the Linux kernel. By abusing the splice system call in combination with crafted socket options, the exploit gains the ability to corrupt...

CVE-2026-99033

A flaw was found in the Linux kernel. A local user with network privileges can trigger a Denial of Service DoS by causing a complete system crash. This issue occurs when a packet socket receives traffic on a network interface that lacks a link-layer header, such as a Controller Area Network CAN...

CVE-2026-98850

A flaw was found in the Linux kernel's packet socket implementation. An integer overflow occurs in the transmission ring buffer when calculating the total byte count of transmitted frames during a send operation. A local user with raw network privileges can exploit this issue to trigger an intern...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143058)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143058 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the...

CVE-2026-98503

A flaw was found in the Linux kernel's packet socket implementation. A local user can cause a Denial of Service DoS or system instability by triggering premature reuse of transmit ring buffer slots while packet data is still in flight. Because these shared memory slots may be released and reused...

PT-2026-117021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the advance nextseg function modifies the Segment Routing Header SRH Segments Left field and the IPv6 destination address without verifying if the packet data is...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndochangemtu to prevent buffer overflow Sending a PFPACKET allows bypassing the CAN framework logic and directly reaching the xmit function of a CAN driver. The only check performed by the PFPACKET framework...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket failed to bind a protocol. Consequently, protocol-bound SOCKRAW sockets, any...

CVE-2026-98233

A flaw was found in the Linux kernel's packet socket implementation. An attacker could cause a Denial of Service DoS by transmitting network packets that fail virtual network header processing. When processing encounters an error, the kernel fails to clear the ownership status of the assigned...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: fixed information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the newly added packettype by reading the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: etases58x: It is necessary to populate ndochangemtu to prevent buffer overflows. Sending a PFPACKET allows bypassing the CAN framework logic and directly reaching the xmit function of a CAN driver. The only check performed by the...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

EUVD-2026-71665

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80906

CVE-2026-80906 affects the Linux kernel net: packet subsystem. In packet_parse_headers(), when handling a VLAN-tagged frame, skb_set_network_header() advances the network header past the VLAN tag before skb_probe_transport_header() is called. This leaves skb->protocol set to the outer VLAN Eth...

CVE-2026-80906 net: packet: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

PT-2026-86197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers function, skb set network header is called to advance the...

SUSE CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

SUSE CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

AZL-97127 CVE-2026-74667 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...