CVE-2026-31431-cleaned

copyFail.py — CVEエクスプロイト解析レポート 概要 copyFail.pyは、Linuxカーネルのローカル権限昇格 の脆弱性を実証する概念実証（PoC）エクスプロイトです。spliceシステムコールを巧妙に細工されたソケットオプションと組み合わせて悪用することで、任意のカーネルメモリを破壊する能力を獲得します。この能力を利用して、ディスク上の任意のsetuidバイナリをカスタムELF実行ファイルで上書きし、改ざんされたバイナリを実行して昇格した権限を取得します。 攻撃タイプ: ローカル権限昇格（LPE） 影響:...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: fixed information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the newly added packettype by reading the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: etases58x: It is necessary to populate ndochangemtu to prevent buffer overflows. Sending a PFPACKET allows bypassing the CAN framework logic and directly reaching the xmit function of a CAN driver. The only check performed by the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The can: hi311x module has corrected the ndochangemtu function to prevent buffer overflows. Sending a PFPACKET allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The only check...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80906

CVE-2026-80906 affects the Linux kernel net: packet subsystem. In packet_parse_headers(), when handling a VLAN-tagged frame, skb_set_network_header() advances the network header past the VLAN tag before skb_probe_transport_header() is called. This leaves skb->protocol set to the outer VLAN Eth...

EUVD-2026-71665

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80906 net: packet: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

PT-2026-86197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers function, skb set network header is called to advance the...

SUSE CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

SUSE CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

AZL-97127 CVE-2026-74667 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

UBUNTU-CVE-2026-74668

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in TXRING send path tpacketsnd reads dev-hardheaderlen independently for skb allocation and header construction in tpacketfillskb. Concurrent netdevice reconfiguration can therefore make the...

UBUNTU-CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

CVE-2026-74668 packet: use consistent hard_header_len in TX_RING send path

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in TXRING send path tpacketsnd reads dev-hardheaderlen independently for skb allocation and header construction in tpacketfillskb. Concurrent netdevice reconfiguration can therefore make the...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74666 packet: synchronize pressure clearing with ring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...