CVE-2026-64563_EXP

CVE-2026-64563EXP 実験研究のみを目的としています。prefetchとnpermのコード（設定が必要なメモリ参照set.gdb）は添付されておらず、最適化も行われていないため、命中確率は低いです。 著者は、この脆弱性の作者が関連情報をすでに公開していることに注目しています：https://github.com/google/security-research/pull/414...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — 研究笔记 概述 该仓库包含一个经过清理的技术示意图和辅助笔记，用于描述通常被称为 Dirty Frag 且针对 xfrm-ESP 路径被追踪为 CVE-2026-43284 的 Linux 内核漏洞。 该问题属于由 Hyunwoo Kim（@v4bel）发现的更广泛的 Dirty Frag 类别。一个相关的 RxRPC 变体被单独追踪为 CVE-2026-43500 。 本材料的目的是： 在系统层面解释漏洞机制； 记录 XFRM ESP、UDP 封装、splice、skb 片段、文件支持页以及页缓存损坏之间的关系；...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone 共有メモリが安全に共有されなくなるとき。 不適切な伝播によって引き起こされるローカル権限昇格の脆弱性、 SKBFLSHAREDFRAG フラグがLinuxネットワーキングスタック内で発生します。 📖 概要 CVE-2026-43503 は、通称DirtyClone と呼ばれる、Linuxカーネルネットワーキングサブシステムに影響を与える高深刻度のローカル権限昇格（LPE）脆弱性です。...

Linux Distros Unpatched Vulnerability : CVE-2026-80600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which...

UBUNTU-CVE-2026-80601

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

Linux Distros Unpatched Vulnerability : CVE-2026-80601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables whic...

UBUNTU-CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

AZL-98114 CVE-2026-80681 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80601

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80612 net: lwtunnel: Drop skb metadata before LWT encapsulation

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612

This Linux kernel vulnerability affects the net lwtunnel (lightweight tunnel) subsystem. When LWT encapsulation prepends outer headers, it moves skb->data over the headroom where XDP/TC skb metadata resides. Non-BPF encaps types (MPLS, Seg6, IOAM6) silently overwrite this metadata via skb_push...

EUVD-2026-67488

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612 net: lwtunnel: Drop skb metadata before LWT encapsulation

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80601 batman-adv: gw: acquire ethernet header only after skb realloc

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

EUVD-2026-67477

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...