TUNderflow

TUNderflow CVE-2026-81000 Writeup !WARNING 本 PoC 仅用于帮助防御者、维护者和经授权的安全团队，在他们拥有或明确获授权测试的系统上验证补丁、缓解措施、检测规则和暴露面。 您需自行负责确保对本材料的使用是合法、经授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会修改 /etc/pam.d/su，且没有任何回滚机制。 一次位置错误的覆写可能会破坏无关的内核内存，导致机器挂起或崩溃。 仅在一次性 VM/可丢弃主机上运行。 该 PoC： 1. 进入私有的用户/网络命名空间，创建 TUN 设备以及...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: OpenVSwitch: fixed the issue where locking occurred when trying to unregister a netdev with a carrier. The commit in the “fixes” tag attempted to fix this issue through the following sequence of calls: dooutput → ovsvportsend →...

kernel: net: openvswitch: Avoid releasing netdev before teardown completes

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdevdestroy...

CVE-2026-31508

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdevdestroy...

CVE-2026-31508

The CVE-2026-31508 issue affects the Linux kernel in the Open vSwitch teardown path. The root cause is that after a patch, the teardown code for OVS ports no longer unconditionally takes the RTNL, allowing netdev_destroy() to finish and free the netdev before unregistration completes if the IFF_O...

CVE-2023-53843

CVE-2023-53843: In the Linux kernel, net: openvswitch: reject negative ifindex has been fixed. The issue arose from net-next changes that reworked pre‑assigned ifindexes and allowed ovs netdev ports to be created with negative ifindex values, which could be surfaced via certain commands and tools...