809 matches found
CVE-2023-22098
CVE-2023-22098 - Oracle VM VirtualBox 7.0.10 r158379 Escape Hey VM Wizards, In 2023, the outstanding security researcher Andy Nguyen @TheFlow0 discovered multiple vulnerabilities in Virtio-net for VirtualBox. All kudos to him for his incredible work. This repository contains the exploit for...
Exploit for CVE-2026-99999
CVE-2026-99999 — Technical Analysis & Attack Chain Study Li...
Exploit for CVE-2026-99999
CVE-2026-99999 KVM checksum metadata non-destructive PoC This...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: virtionet: Added a check for hashkeylength. A check for hashkeylength was added in virtnetprobe to avoid possible out-of-bounds errors when setting/read the hash key...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fixed the len check in receivebig. receivebig limits the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. This still results in an insufficient limit. addrecvbufbig sets sg1 to start at offset sizeofstru...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: In the net module, there is a issue where packets with the type UFO are dropped in the udprcvSegment function. When sending a packet with the virtionethdr structure to a tun device, if the gsotype field in the virtionethdr...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets do not overflow the gsosegs field. The user can specify any value less than TCPMINGSOSIZE = 8 for the gsosize parameter in a packet sent using a AFPACKETPACKETVNETHDR socket. At the same time,...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: virtio-net: The issue of checking the received length in large packets has been fixed. Since commit 4959aebba8c0 “virtio-net: Use the MTU size as the buffer length for large packets”, when the guest gso is disabled, the allocated...
CVE-2026-90063
A flaw was found in virtio-net, a network virtualization driver in the Linux kernel. A local user could exploit this vulnerability by crafting a specially designed TCP packet with a small gsosize value. This action could lead to an integer overflow in the gsosegs field during packet processing,...
CVE-2026-98233 net/packet: clear RX owner on VNET header error
In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: virtionet: Fixed the NAPI skbcacheput warning. After the commit bdacf3e34945 “net: Use nested-BH locking for napialloccache.” was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: virtionet: a memory leak inside XPDTX has been fixed using mergeable. When we call xdpconvertbufftoframe to obtain xdpf, if it returns NULL, we should check whether xdppage was allocated by xdplinearizepage. If it was newly...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: net: Missing check for virtio Two missing checks in virtionethdrtoskb allowed syzbot to crash kernels again. 1. After the skbsegment function, the buffer may become non-linear nrfrags != 0. However, since the SKBTXSHAREDFRAG...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that the received length does not exceed the allocated size. In xdplinearizepage, when reading the following buffers from the ring, we forget to check the received length against the actual allocated size. This...
Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (crlsa-2025_4492)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254492 advisory. QEMU: virtio-net: stack buffer overflow in virtionetflushtx CVE-2023-6693 qemu-kvm: net: assertion failure in updatesctpchecksum CVE-2024-3567 Tenable has...
Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc Multiple Vulnerabilities (crlsa-2022_5821)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225821 advisory. QEMU: QXL: integer overflow in cursoralloc can lead to heap buffer overflow CVE-2021-4206 QEMU: QXL: double fetch in qxlcursor can lead to heap buffer...
AlmaLinux 9.2 [TuxCare] Security Update: qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-audio-pa / etc (ALMALINUX9.2:CLSA-2026:1779097389)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779097389 advisory. - A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtionetflushtx functi...
SUSE CVE-2026-97989
In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...
