CVE-2026-53366 ipv4: account for fraggap on the paged allocation path

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

CVE-2026-53366

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

CVE-2026-53366

CVE-2026-53366 affects the Linux kernel IPv4 path. In __ip_append_data(), the paged-allocation branch miscomputed alloclen/pagedlen due to fraggap carried from the previous skb, causing the linear area to be undersized. The patch corrects this by adding the fraggap to alloclen and subtracting it ...

CVE-2026-53366

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

PT-2026-60411

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 7.1.4-1.1 Description An issue exists in the IPv4 implementation within the ip append data function. When the paged-allocation branch is executed, the alloclen and pagedlen variables are calculated incorrectly...

UBUNTU-CVE-2017-16797

In SWFTools 0.9.2, the pngload function in lib/png.c does not properly validate an alloclen64 multiplication of width and height values, which allows remote attackers to cause a denial of service integer overflow, heap-based buffer overflow, and application crash or possibly have unspecified othe...