CVE-2026-90127

This Linux kernel vulnerability affects the virtio RTC driver. The root cause is that RTC alarm requests wait without a timeout for the device to return request buffers. On surprise removal , virtio-pci marks the virtqueues broken before unregistering the device; if an alarm request is in flight ...

CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

EUVD-2026-81924

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

CVE-2026-90063

CVE-2026-90063 is a vulnerability in the Linux kernel's virtio-net driver. A user can specify a gso_size smaller than 8 (below TCP_MIN_GSO_SIZE) in a packet crafted via an AF_PACKET PACKET_VNET_HDR socket. Because GSO_MAX_SIZE equals 8 × 65535, dividing the SKB length by a gso_size

CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs th...

kernel: hwrng: virtio: clamp device-reported used.len at copy_data()

A flaw was found in the Linux kernel's virtio-rng driver. A malicious or buggy virtualized hardware random number generator virtio-rng backend can report an overly large data length to the guest operating system. This unchecked length can lead to an out-of-bounds read, causing the driver to acces...

CVE-2026-90127: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal,...

PT-2026-94411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio-net component where a user can specify an arbitrary gso size in a packet crafted with an AF PACKET PACKET VNET HDR socket. If the gso size is set to a value...

CVE-2026-90063: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3820)

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before...

CVE-2026-56923

In handleunmapreq of tipcvirtiodev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56923

In handleunmapreq of tipcvirtiodev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56923

A memory corruption vulnerability exists in the handle_unmap_req function of tipc_virtio_dev.c . This flaw is caused by a race condition (improper synchronization during concurrent execution using a shared resource), which could allow for local escalation of privilege without requiring additional...

CVE-2026-56923

In handleunmapreq of tipcvirtiodev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-77179

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-77179 Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

EUVD-2026-78467

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-77179

CVE-2026-77179 is a CRITICAL (CVSS 4.0: 9.4) vulnerability in Docker Sandboxes on macOS. The virtio-fs host server improperly follows symlinks when reopening an unlinked file from a stored path, allowing a malicious guest to replace a parent directory with a symlink, escape the shared workspace, ...

CVE-2026-77179 Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...