DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

EUVD-2026-101066

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98417

The Linux kernel contains a vulnerability where ESP-in-TCP can process xfrm packets with transport header offsets that no longer fit after the stream parser trims the TCP envelope. This issue occurs because the plain transport header reset truncates the offset, triggering the skb warning path . T...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-90160

A flaw was found in the Linux kernel's Lightweight Tunnel BPF lwtbpf component. An attacker, by using a specially crafted BPF program, could cause an insufficient headroom condition after the program modifies the socket buffer skb head. This can lead to the kernel dropping network packets,...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone When Shared Memory Stops Being Shared Safely. A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFLSHAREDFRAG flag inside the Linux networking stack. 📖 Overview CVE-2026-43503 , nicknamed DirtyClone , is a High Severity Local Privileg...

CVE-2026-64563_EXP

CVE-2026-64563EXP For experimental research only. The code for prefetch and nperm the memory reference set.gdb needs to be configured is not attached, and since it has not been optimized, the hit probability is low. The author noticed that the vulnerability author has already released relevant...

PT-2026-108763

In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlan insert inner tag vlan insert inner tag only guarantees head room via skb cow head, never that mac len bytes of MAC header are present. Its ETH HLEN wrappers - vlan insert tag und...

PT-2026-108769

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf skb pull data for LWT SEG6LOCAL An LWT SEG6LOCAL program can invalidate its cached SRH with bpf lwt seg6 adjust srh and then call bpf skb pull data. The latter may reallocate skb-head, leaving the per-CPU SRH...

CVE-2026-31429-POC

CVE-2026-31429 — Linux Kernel: Cross-Cache Free of KFENCE-Allocated SKB Head via bpfprogtestrunskb Severity: Medium CWE-763: Release of Invalid Pointer or Reference Published: 2026-04-20 Affected subsystem: net/core/skbuff.c — skbkfreehead Researcher: Antonius / w1sdom — Blue Dragon Security...

kernel: ice: fix double-free of tx_buf skb

A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...

SUSE SLES15 Security Update : kernel (Live Patch 21 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4538-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4538-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.81 fixes one security issue: The following security issue was fixed: - CVE-2026-74612:...

DEBIAN-CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98274

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

DEBIAN-CVE-2026-98274

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98274

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...