page-cache-corruption-lpes

ページキャッシュ破壊 LPE Linux カーネルのローカル特権昇格エクスプロイト 3 種。Dirty COW や Dirty Pipe と同じバグクラス。数秒で root シェル。主要なディストリビューションすべてに影響。 3 つすべてがカーネルのページキャッシュ — プロセスが実際に読み取り実行するファイルのメモリ内コピー — を破壊します。ディスク上のファイルには一切触れません。ファイル整合性ツールは何も検知しません。execve"/usr/bin/su" はキャッシュから読み込み → あなたのシェルコードを実行 → root。 エクスプロイト エクスプロイト| CVE| メカニズ...

CVE-2026-80725

A flaw was found in the Linux kernel’s Generic Receive Offload GRO component, which handles network packet aggregation. Improper validation of BIG TCP aggregation criteria allows a remote attacker to send specially crafted network frames. This can lead to an out-of-bounds write when processing IP...

CVE-2026-80725

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

AZL-98223 CVE-2026-80725 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

EUVD-2026-68066

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

CVE-2026-80725

CVE-2026-80725 affects the Linux kernel 's GRO (Generic Receive Offload) BIG TCP aggregation path in skb_gro_receive(). A prior commit (b1a78b9b9886) loosened validation, allowing crafted frames injected via AF_PACKET to pass incorrect headroom checks. When ipv6_gro_complete() inserts a temporary...

CVE-2026-80725 net: gro: properly validate BIG TCP aggregation criteria

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

Linux Distros Unpatched Vulnerability : CVE-2026-80725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted f...

MiracleLinux 9 : kernel-5.14.0-687.25.1.el9_8 (AXSA:2026-1687:69)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1687:69 advisory. kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of...

EUVD-2026-66572

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

CVE-2026-74742

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

UBUNTU-CVE-2026-74742

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

CVE-2026-74742

Linux kernel veth has a bug where veth_poll() derives the peer TX queue index from rq->xdp_rxq.queue_index, a field only populated when an XDP program is attached. On the plain GRO/NAPI path the value stays 0 for every queue. In a multi-queue setup with GRO enabled and no XDP, all NAPI pollers...

CVE-2026-74742 veth: fix queue index used to wake the peer txq in veth_poll

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

CVE-2026-74742 veth: fix queue index used to wake the peer txq in veth_poll

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

PT-2026-82122

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the veth poll function where the index of the peer TX queue to wake is incorrectly derived from rq-xdp rxq.queue index. This field is only initialized when an XDP...

Linux Distros Unpatched Vulnerability : CVE-2026-74742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is onl...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net: gro subsystem, do not merge the zcopy state. The skbgroreceive function currently copies fragments between the source skb and the GRO. This process does not check the zerocopy status, especially the SKBFLMANAGEDFRAGRE...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fou: Fixed the null-ptr-deref in GRO. We observed a null-ptr-deref in fougroreceive while shutting down a host. 0 The NULL pointer is sk-skuserdata, and the offset 8 represents protocol in struct fou. When fourelease is called du...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data. The driver needs to keep track of all possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256, and the...