CVE-2024-38063

CVE-2024-38063 - Windows TCP/IP リモートコード実行の脆弱性。BSOD の発生が RCE につながる可能性がありますが、私のコードは BSOD のみを引き起こします。私はパッチの分析とターゲットシステムでの RCE 発生につながるテストを継続的に行っています。 スター履歴 概要 CVE-2024-38063 は、Windows TCP/IP スタックにおける重大なセキュリティ脆弱性であり、リモートコード実行 RCE を可能にします。この脆弱性は、Windows が IPv6...

CVE-2018-4407

CVE-2018-4407 Apple の ICMP パケット処理コード（CVE-2018-4407）における out-of-bounds write（領域外書き込み）によって引き起こされるカーネルクラッシュ。iOS 11.0、11.2、11.3.1 に影響。...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firewire: net: Fix for use after free in fwnetfinishincomingpacket The netifrx function frees the skb, so we cannot dereference it to save skb-len...

RHEL 8 : kernel (RHSA-2026:63537)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63537 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: packet: use consistent hardheaderlen i...

CVE-2026-80590

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

MiracleLinux 9 : kernel-5.14.0-687.25.1.el9_8 (AXSA:2026-1687:69)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1687:69 advisory. kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed a crash that occurred during module load/unload tests. During the purex packet handling, the driver incorrectly freed a pre-allocated structure. This issue was fixed by skipping that specific entry in the...

PT-2026-80924

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...

CVE-2026-18282

Sony XAV-9500ES AVRCPBrResponseParser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

CVE-2026-18281

CVE-2026-18281 is a heap-based buffer overflow in the Sony XAV-9500ES car audio/video receiver, specifically in the l2_reassemble_sdu function that handles Bluetooth L2CAP packets . The root cause is the lack of proper length validation on user-supplied data before copying it into a heap-based bu...

Linux Distros Unpatched Vulnerability : CVE-2026-74429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrp...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101983)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101983 advisory. In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdiscpktlensegsinit Most ndostartxmit methods expects headers of gso packet...

UBUNTU-CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74430 rxrpc: Fix ACKALL packet handling

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74429 rxrpc: Fix the reception of a reply packet before data transmission

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpcreceivingreply to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call ...

CVE-2026-74430

The CVE-2026-74430 issue affects the Linux kernel’s rxrpc ACKALL handling. It allowed a forged ACKALL to reach a new service call before replies were queued, risking a null-pointer dereference when rxrpc_rotate_tx_window() dereferenced a NULL txqueue (call->tx_top was zero). The fix adds two c...

CVE-2026-72334 Bluetooth: ISO: fix malformed ISO_END/CONT handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

CVE-2026-72230 batman-adv: frag: free unfragmentable packet

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error...

PT-2026-72866

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc input ackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new servic...