180311 matches found
DEBIAN-CVE-2026-98382
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...
CVE-2026-98382
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...
CVE-2026-98384
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
CVE-2026-98375
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handleincomingqueue pulls pullto bytes into the head before calling ethtypetrans. pullto is the length of the first RX slot, capped at RXCOPYTHRESHOLD, and that length...
CVE-2026-19571
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-98384
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
UBUNTU-CVE-2026-98384
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
UBUNTU-CVE-2026-98377
In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlaninsertinnertag vlaninsertinnertag only guarantees head room via skbcowhead, never that maclen bytes of MAC header are present. Its ETHHLEN wrappers - vlaninserttag under...
CVE-2026-98375
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handleincomingqueue pulls pullto bytes into the head before calling ethtypetrans. pullto is the length of the first RX slot, capped at RXCOPYTHRESHOLD, and that length...
kernel: nvmet-rdma: handle inline data with a nonzero offset
A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...
CVE-2026-98384 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
CVE-2026-98384 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
CVE-2026-98384
The Linux kernel contains an out-of-bounds read vulnerability in the bpf subsystem within the bpf_sock_destroy() function. The issue arises because the code attempts to read sk_protocol from a sock structure; however, for timewait or request sockets handed to the function by the tcp iterator, thi...
EUVD-2026-95539
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...
CVE-2026-98377
The Linux kernel contains a vulnerability in the vlan component where the __vlan_insert_inner_tag() helper function fails to verify the presence of a MAC header before rewriting the first 16 bytes. Specifically, on IFF_TUN devices with hard_header_len == 0, the system may accept a one-byte AF_PAC...
CVE-2026-98377 vlan: require the MAC header to be present in __vlan_insert_inner_tag()
In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlaninsertinnertag vlaninsertinnertag only guarantees head room via skbcowhead, never that maclen bytes of MAC header are present. Its ETHHLEN wrappers - vlaninserttag under...
CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
EUVD-2026-95527
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-19571
A race condition exists in the ITE IT8xxx2 SHI host-command backend (specifically in ec_host_cmd_backend_shi_ite.c) within the Zephyr RTOS. The vulnerability occurs because the driver copies the 8-byte host-command request header from the SPI Rx FIFO into the shared receive buffer (data->in_ms...