2022-LPE-UAF

2022-LPE-UAF 未经测试的POC代码 安全研究人员发现了 Linux 内核中的 3 个漏洞，这些漏洞可能允许本地攻击者提升权限并潜在地执行恶意代码。概念验证代码已公开，增加了在野利用的可能性。 关于 Dirtycred 的论文（作者：Zhenpeng） https://zplin.me/papers/DirtyCred-Zhenpeng.pdf DirtyCred 的补丁以及 PoC 的公开版本 https://github.com/Markakd/DirtyCred CVE-2022-2585 - Linux 内核 POSIX CPU 定时器 UAF 'PoC' 代码来源：...

2022-LPE-UAF

2022-LPE-UAF Código POC no probado Investigadores de seguridad descubrieron 3 vulnerabilidades en el kernel de Linux que podrían permitir a un atacante local elevar privilegios y potencialmente ejecutar código malicioso. El código de prueba de concepto está disponible públicamente, lo que aumenta...

CVE-2026-97959

A flaw was found in the Linux kernel. When an existing clsroute traffic control filter is moved to a different bucket during configuration updates, the kernel fails to free the vacated bucket once it becomes empty. This failure leaves stale bucket references in place and prevents the associated...

DEBIAN-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

AZL-104640 CVE-2026-97959 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

UBUNTU-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

The Linux kernel contains a memory leak vulnerability in the net/sched: cls_route component. When an existing filter is moved to a different top-level bucket via route4_change, the filter is unlinked from the old bucket, but the bucket is never freed. This results in stale empty buckets remaining...

CVE-2026-97959 net/sched: cls_route: free emptied bucket on filter move

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959 net/sched: cls_route: free emptied bucket on filter move

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

EUVD-2026-86813

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

Linux Distros Unpatched Vulnerability : CVE-2026-97959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

It was discovered that the clsRoute filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it, if its handle had the value 0...

SUSE CVE-2026-74583

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

CVE-2026-74583

A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...

AZL-96998 CVE-2026-74583 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

CVE-2026-74583

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...