kernel: xfrm: ah6: validate routing header segments_left

A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 Authentication Header for IPv6 module. The ipv6rearrangerthdr function does not properly validate the segmentsleft field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacke...

audit-kernel

Linux カーネル監査サブシステム ============================================================================= https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git https://github.com/linux-audit/audit-kernel Linux Audit...

DirtyFrag-go

dirtyfrag-go 2つのバグ。1つのシェル。ディスク書き込みなし。 dirtyfrag（CVE-2026-43284 / CVE-2026-43500）のGo移植版です。 動作の仕組み（要約） このバグクラスはLinuxカーネルのXFRMサブシステムに存在します。ファイルページがパイプにspliceされ、その後ESP暗号化ソケットに送られると、カーネルはESPペイロードをその場で復号化します - ソースファイルのページキャッシュページに直接書き込まれます。ファイルは読み取り専用です。しかしページキャッシュはそうではありません。...

kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user()

A flaw was found in the Linux kernel's block integrity subsystem. Incorrect handling of bio integrity vector counts in the biointegritycopyuser function can lead to an out-of-bounds read during write operations. This vulnerability may allow a local attacker to cause a denial of service or...

optee-qemu

CVE-2021-44733：Linux 内核 TEE 子系统中释放后使用漏洞的模糊测试与利用 最近，在 Linux 内核 TEE 子系统中发现了一个释放后使用漏洞，影响版本直至并包括 5.15.11，已分配编号 CVE-2021-44733 1。 乍一看，由于多种原因，它似乎不可利用；然而，在进一步分析漏洞代码路径并实现一个粗糙的概念验证漏洞利用后，可以覆盖内核中的函数指针。本文不提供权限提升载荷，但运行 OPTEE 和该漏洞利用的完整环境可供进一步测试，请参阅“设置环境”部分。 背景 TEE（可信执行环境，Trusted Execution...

kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user()

A flaw was found in the Linux kernel's block integrity subsystem. Incorrect handling of bio integrity vector counts in the biointegritycopyuser function can lead to an out-of-bounds read during write operations. This vulnerability may allow a local attacker to cause a denial of service or...

CVE-2026-84713

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

CVE-2026-84713

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

CVE-2026-84713 Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

EUVD-2026-85610

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

CVE-2026-84713

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

XCP_ng_CVE-2026-43284_tester

XCP-ng Dirty Frag 診断 — CVE-2026-43284 XCP-ng dom0 ホストが CVE-2026-43284 （「Dirty Frag」）に曝露されているかどうかを判定するコミュニティ製診断ツールです。これは、Linux カーネルの xfrm-ESP サブシステムにおけるローカル権限昇格の脆弱性です。 TL;DR（要約） — 標準の 4.19 dom0 カーネルを実行している現在の XCP-ng リリース（8.1、8.2、8.3）はすべて、脆弱なコード範囲に該当します。2026年5月現在、公式の XCP-ng...

kernel: netfilter: nat: use kfree_rcu to release ops

A flaw was found in the Linux kernel's netfilter component, specifically within the Network Address Translation NAT subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system cras...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

kernel: netfilter: nat: use kfree_rcu to release ops

A flaw was found in the Linux kernel's netfilter component, specifically within the Network Address Translation NAT subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system cras...

ROS-20260923-73-0076

The vulnerability of the posixtimerbyid function in the kernel/time/posix-timers.c module of the Linux timer subsystem is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

ROS-20260923-73-0094

The vulnerability of the smb2findcontextvals function in the fs/smb/server/oplock.c module of the SMB subsystem in the Linux operating system is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to gain access to...

CVE-2026-84713: Authorization Bypass Through User-Controlled Key

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

kernel: Bluetooth: serialize accept_q access

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the acceptq within the btsockpoll function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardow...

kernel: Bluetooth: serialize accept_q access

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the acceptq within the btsockpoll function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardow...