149722 matches found
CVE-2026-74612
CVE-2026-74612 is a CRITICAL (CVSS 10.0) flaw in the Linux kernel's veth component. When an XDP program shrinks the fragment area, veth_xdp_rcv_skb() fails to update skb->len, causing skb_headlen() to exceed the actual linear area. In the UDP receive path, __skb_datagram_iter() then copies 102...
EUVD-2026-64548
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...
CVE-2026-74603
CVE-2026-74603 is an over-read vulnerability in the Linux kernel's ptp: ocp module. The EEPROM board ID is a fixed 13-byte field not guaranteed to contain a NUL terminator; passing it directly to devlink_info_version_fixed_put() treats it as a C string, potentially reading beyond its intended mem...
CVE-2026-74597
This vulnerability affects the Linux kernel 's ip6_tunnel module, specifically the ip6ip6_err() function. When processing an outer IPv6 ICMP error packet, the function clones and pulls the skb to the quoted inner IPv6 packet but fails to clear skb2->cb[], leaving the outer packet's inet6_skb_p...
EUVD-2026-64534
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...
CVE-2026-74598
CVE-2026-74598 is an out-of-bounds read in the Linux kernel's IPv6 stack, specifically in rt6_route_rcv() handling of the Route Information option (RFC 4191). Both length checks are off by one: the code accepts length >= 2 and length >= 1 where RFC 4191 requires stricter bounds. A remote at...
CVE-2026-74597 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...
CVE-2026-74598 ipv6: fix Route Information option length validation
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
EUVD-2026-64535
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
CVE-2026-74598 ipv6: fix Route Information option length validation
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
CVE-2026-74597 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...
CVE-2026-74585 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...
CVE-2026-74585
CVE-2026-74585 is an out-of-bounds pointer dereference in the Linux kernel thunderbolt subsystem. The function tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], but the sibling field entry->dual_link_...
EUVD-2026-64522
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...
CVE-2026-74585 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against sw-config.maxportnumber before indexing sw-ports, but the sibling field...
CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
CVE-2026-68768
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...
CVE-2026-68768
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...
UBUNTU-CVE-2026-68768
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...
CVE-2026-68768 hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...