siper

Siper シールド Siper は、Go と C eBPF で構築された、XDP ベースの高性能 IP ブラックリストファイアウォールです。Linux ネットワークスタックの中で最も早い段階、つまりネットワークドライバレベルで悪意のあるトラフィックをドロップできます。XDP 高速データパス を活用することで、パケットはカーネルの重いネットワークサブシステムに到達する前に処理され、激しい DDoS 条件下でも極めて高いパフォーマンスを発揮します。 機能 XDP による高性能 ：パケットフィルタリングは XDPDROP を使用して NIC ドライバレベルで行われ、iptables や...

CVE-2026-86287

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-86287

Net::IP::LPM (Perl) versions before 1.12 accept malformed prefix lengths: non-numeric and non-ASCII values are treated as 0, and integers over 31 bits are silently truncated. A single malformed mask poisons the lookup table , causing every subsequent lookup to succeed. In practice, an allow-list ...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

EUVD-2026-72526

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

SUSE CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

UBUNTU-CVE-2026-72307

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

CVE-2026-72307 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

EUVD-2026-59206

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxswspvrslpmtreereplace When mlxswspvrslpmtreereplace fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but...

SUSE CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

AZL-93611 CVE-2026-64352 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

UBUNTU-CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

EUVD-2026-48896

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

CVE-2026-64352 affects the Linux kernel BPF subsystem , specifically the LPM (Longest Prefix Match) trie implementation in kernel/bpf/lpm_trie.c. The root cause is incorrect RCU lock annotations : trie_lookup_elem() used rcu_read_lock_bh_held() which does not accept the Tasks Trace RCU held by sl...

PT-2026-64573

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.0 Description An issue exists in the Linux kernel where sleepable BPF programs cannot properly access Longest Prefix Match LPM maps. The function trie lookup elem uses an annotation that only validates classi...