622 matches found
CVE-2026-55200
🚨 CVE-2026-55200 - Critical libssh2 Out-of-Bounds Write Vulnerability 📌 Overview CVE-2026-55200 is a critical memory corruption vulnerability affecting the widely deployed libssh2 library. The flaw arises from improper validation of the SSH packet length field during packet processing, potentiall...
CLSA-2024-1711026398 kernel: Fix of 9 CVEs
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-2023-39197 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - media: pvrusb2: fix use after free on context disconnection CVE-2023-52445 - net: prevent mss overflow in skbsegment...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skbput When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtiovsockskbrxput. Unfortunately, virtiovsockskbrxput uses the length...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: Check the packet for fixup for true limits. If a device sends a packet that lies between 0 and sizeofu64, the value passed to skbtrim as the packet length will wrap around, resulting in a very large value. The driver...
Astra Linux – vulnerability in linux-5.10, linux-5.15, linux
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not redirect packets with invalid pktlen Syzbot identified an issue 1: fqcodeldrop attempts to drop a flow without any skbs; that is, flow-head is null. As stated in 2, the root cause is that bpfprogtestrunskb runs a BPF...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: net: mana: Validates the packet length reported by the Network Interface Card NIC. The packet length reported in the RX Command Queue Element CQE is validated before being passed to skb processing. The CQE is provided by the NIC...
Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdiscpktleninit One path handles the SKBGSODODGY condition by checking that skb-len is greater than hdrlen. virtionethdrtoskb does not fully dissect TCP headers; it merely ensures they are at least ...
EUVD-2026-101342
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...
CVE-2026-75084
The TI CC1200 IEEE 802.15.4 driver contains an out-of-bounds write vulnerability in drivers/ieee802154/ieee802154_cc1200.c. The root cause is insufficient validation of the PHY packet length from the radio's RX FIFO in verify_rxfifo_validity(), which fails to bound large values when the radio is ...
CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
CVE-2026-106585
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...
AZL-106691 CVE-2026-106585 affecting package openssh 9.8p1-10
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...
CVE-2026-106585
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...
CVE-2026-106585
The OpenSSH sshd and ssh components in versions before 10.6 are vulnerable to a data amplification issue. The root cause is a lack of checks to determine if the maximum packet length is exceeded when decompressing highly compressed data . This vulnerability could lead to impacts on integrity and ...
CVE-2026-104037 Sssd: sssd: denial of service via packet length underflow in autofs responder
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...
CVE-2026-104037
A vulnerability exists in SSSD where a local attacker can trigger a denial of service (DoS) . By sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket , the attacker can cause an integer underflow and an out-of-bounds memory read . This flaw leads t...
PT-2026-107283
Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.6 Description The sshd and ssh components fail to verify if the maximum packet length is exceeded when decompressing highly compressed data. Recommendations Update to version 10.6 or later...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Avoid reading uninitialized memory in ath9khtcrxmsg. syzbot reports that the uninitialized value is accessed at ath9khtcrxmsg. For ioctlUSBRAWIOCTLEPWRITE, the function ath9khifusbrxstream may call ath9khtcrxmsg with...
Astra Linux – Vulnerability in libslirp
In ncsi.c within libslirp up to 4.3.1, there is an issue of buffer over-reading. This occurs because the program attempts to read a certain amount of header data, even when that amount exceeds the total packet length...