3187 matches found
CVE-2026-64531
🔥 CVE-2026-64531 — OVSwrap Linux 커널 Open vSwitch 메모리 손상 🩸 취약점 개요 CVE-2026-64531 은 Linux 커널 Open vSwitchOVS 네트워킹 서브시스템에 영향을 미치는 보안 취약점입니다. 이 결함은 Netlink 중첩 속성 처리 과정에서 발생하며, 과도하게 큰 액션 구조가 크기 제한을 우회하여 안전하지 않은 커널 메모리 연산을 유발할 수 있습니다. ⚠️ 성공적인 악용 시 커널 크래시, 서비스 거부, 또는 권한 상승 으로 이어질 수 있습니다. 🧬 기술 정보 🏷️ 필드| 📌...
CVE-2017-11176
CVE-2017-11176 CVE-2017-11176에 대한 코드 실행 개념 증명PoC입니다. 취약점 Linux 커널 4.11.9까지의 mqnotify 함수는 재시도 로직 진입 시 sock 포인터를 NULL로 설정하지 않습니다. 사용자 공간에서 Netlink 소켓을 닫는 동안 공격자가 서비스 거부use-after-free를 유발하거나 기타 지정되지 않은 영향을 미칠 수 있도록 허용합니다. 참고 https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part1.html...
CVE-2026-89691
A flaw was found in the Linux kernel's Network File System Daemon nfsd component. The nfsd4releasecompoundargs function does not properly clear an internal counter opcnt when releasing a buffer. This oversight can lead to an out-of-bounds read, allowing an attacker to access adjacent memory and...
CVE-2026-80996
A flaw was found in the Linux kernel's L2TP Layer 2 Tunneling Protocol networking component. Specifically, the netlink handlers responsible for creating and modifying L2TP tunnels and sessions may fail to propagate multicast notification errors. This can lead to calling applications retrying...
CVE-2026-89700
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...
DEBIAN-CVE-2026-89690
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...
CVE-2026-89691
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
CVE-2026-89690
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...
CVE-2026-80996
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...
CVE-2026-89698
CVE-2026-89698 is a Linux kernel vulnerability in the NFS daemon (nfsd) generic netlink interface. The rq_daddr and rq_saddr fields in struct nfsd_genl_rqstp are declared as struct sockaddr (16 bytes), but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 * (28 bytes) when an I...
CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...
EUVD-2026-76610
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...
CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
CVE-2026-89691
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
EUVD-2026-76603
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
EUVD-2026-76602
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...
CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...
EUVD-2026-76319
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...