CVE-2026-8718

CVE-2026-8718 affects Zephyr net sockets TLS with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID and an established DTLS session. tls_opt_dtls_peer_connection_id_value_get() passes optval to mbedtls_ssl_get_peer_cid() without ensuring the destination buffer is large enough (MBEDTLS_SSL_CID_OUT_LEN_MAX, de...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

PT-2026-69999

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.5.0 and later Description An out-of-bounds write exists in the tls opt dtls peer connection id value get function within subsys/net/lib/sockets/sockets tls.c. This function handles the getsockoptSOL TLS, TLS DTLS PEER CID VAL...

FreeBSD : FreeBSD -- Race condition in ELF core dump segment counting (ced14fa7-8bb8-11f1-a6ab-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ced14fa7-8bb8-11f1-a6ab-bc241121aa0a advisory. The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the...

CVE-2026-64456

A flaw was found in the Linux kernel's virtio-rng driver. A malicious or buggy virtualized hardware random number generator virtio-rng backend can report an overly large data length to the guest operating system. This unchecked length can lead to an out-of-bounds read, causing the driver to acces...

Linux Distros Unpatched Vulnerability : CVE-2026-64540

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length...

UBUNTU-CVE-2026-64479

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...

CVE-2026-10677

The CVE concerns Zephyr’s CONFIG_USERSPACE verifier z_vrfy_k_poll() in kernel/poll.c, where a user-supplied k_poll_event[] is copied to kernel space and validated. Previously, an inline K_OOPS(K_SYSCALL_OBJ(...)) inside the loop could leak the allocation when a forged object handle was encountere...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

CVE-2026-15422

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification i.e. before SCTP integrity checks or IPsec policy are applied a remote, unauthenticated...

CVE-2026-15449

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

CVE-2026-15422 SCTP needs to better-check INIT ACK chunk parameters

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification i.e. before SCTP integrity checks or IPsec policy are applied a remote, unauthenticated...

EUVD-2026-45014

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification i.e. before SCTP integrity checks or IPsec policy are applied a remote, unauthenticated...

CVE-2026-15422 SCTP needs to better-check INIT ACK chunk parameters

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification i.e. before SCTP integrity checks or IPsec policy are applied a remote, unauthenticated...

CVE-2026-15422

CVE-2026-15422 concerns illumos SCTP where the inbound path performs association lookups for INIT ACK chunks without validating the address parameters. The vulnerability is triggered during packet classification, before SCTP integrity checks or IPsec policies, allowing a remote, unauthenticated a...

CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

EUVD-2026-45034

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

CVE-2026-15449

CVE-2026-15449 describes a TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) regarding handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. In drv_ioc_prop_common(), the header is read once to obtain pr_valsize, a kernel heap buffer is allocated, and then the fu...