GHSA-G6V3-7XMC-W563 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

Summary The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with makeuint32, n where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a...

CVE-2026-54345

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

CVE-2026-54345 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

CVE-2026-64355

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter devmap feature. When handling devmap broadcast redirects, fragmented network frames are not properly managed during the cloning process. This can lead to an out-of-bounds access, where the system attempts to read or write data beyo...

SUSE-SU-2026:3362-1 Security update for samba

This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-byt...

CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

UBUNTU-CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

UBUNTU-CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

PT-2026-65633

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

C-RE-ACT: Causal RE-ACTing Agent for O-RAN Forensic Triage

The shift to O-RAN architectures marks a turning point in cellular security, where increased openness and modularity directly translate into a broader attack surface. Among the security threats cataloged by the O-RAN Alliance Working Group 11, performance-degradation attacks constitute the larges...

The CTDB protocol has bounds checking issues

== Summary: CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. Description CTDB fails to do a number of integrity checks on received packets. This includes: checking of field lengths against pack...

PT-2026-65684

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

Linux Distros Unpatched Vulnerability : CVE-2026-64547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the...

Linux Distros Unpatched Vulnerability : CVE-2026-64548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and...

CVE-2026-64547

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the skb-len != packetlen check further down, and packetlen is only bound...

UBUNTU-CVE-2026-64547

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the skb-len != packetlen check further down, and packetlen is only bound...

UBUNTU-CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64547

CVE-2026-64547 affects the Linux kernel net1080 USB network driver. The issue arises when an even packet_len is processed by net1080_rx_fixup: it reads the pad byte at skb->data[packet_len] before verifying skb->len, with packet_len only bounded by NC_MAX_PACKET, enabling a malicious NetChi...