CVE-2026-23204

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: use skbheaderpointercareful skbheaderpointer does not fully validate negative @offset values. Use skbheaderpointercareful instead. GangMin Kim provided a report and a repro fooling u32classify: BUG: KASAN:...

CVE-2026-23140

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Subtract size of xdpframe from allowed metadata size The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which...

UBUNTU-CVE-2026-23140

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Subtract size of xdpframe from allowed metadata size The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which...

CVE-2026-23140

CVE-2026-23140 is a Linux kernel vulnerability resolved in kernel patches related to BPF/XDP handling. The issue arises in bpf_test_run where the metadata size isn’t constrained by the actual xdp_frame headroom, allowing a userspace-supplied metadata size that can exhaust headroom. In live packet...

CVE-2026-23140 bpf, test_run: Subtract size of xdp_frame from allowed metadata size

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Subtract size of xdpframe from allowed metadata size The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which...

CVE-2026-23140 bpf, test_run: Subtract size of xdp_frame from allowed metadata size

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Subtract size of xdpframe from allowed metadata size The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which...

CVE-2026-23140

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Subtract size of xdpframe from allowed metadata size The xdpframe structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpftestrun, we don't take this into account, which...

UBUNTU-CVE-2026-23122

In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW Use...

EUVD-2026-5914

In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW Use...

CVE-2026-23122

The CVE-2026-23122 entry concerns the Linux kernel igc TSN TX packet buffer sizing. Affected component: i226 TSN support in the Linux kernel driver (igc). Root cause: reducing the TX buffer per queue from 7 KB to 5 KB to resolve TX unit hangs under heavy timestamping load. Impact: the change addr...

CVE-2026-23122

In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW Use...

OSV-2026-240 Use-of-uninitialized-value in packet_get1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=483928517 Crash type: Use-of-uninitialized-value Crash state: packetget1 gpsdpoll FuzzDrivers.c...

GHSA-C7PH-F7JM-XV4W rPGP's integrity protection of encrypted data was not always checked

Summary For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid. Details When decrypting SEIPD Symmetrically Encrypted and Integrity Protected Data Packet, rPGP previously did not under all circumstances report the absence of valid...

CVE-2025-70123

An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly accepts a malformed PFCP Association Setup Request, violating 3GPP TS 29.244. This places the UPF in an inconsistent state where a...

CVE-2025-69807

p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause a denial of service via a packet sent to the server...

CVE-2025-67433

A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a Denial of Service DoS via a crafted DATA packet...

CVE-2025-69806

p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get relative information leakage via a packet sent to the server...

Yokogawa Electric Corporation Vnet/IP Interface 安全漏洞

Yokogawa Electric Corporation Vnet/IP Interface is a real-time control network interface of Yokogawa Corporation. Versions of Yokogawa Electric Corporation Vnet/IP Interface prior to R1.07.00 contained a security vulnerability. This vulnerability stemmed from the handling of malicious data packet...

CVE-2025-70122

CVE-2025-70122 affects free5GC v4.0.1 UPF. The root cause is a heap buffer overflow in SDFFilterFields.UnmarshalBinary (sdf-filter.go) triggered when a declared length exceeds the actual buffer capacity, causing a runtime panic and UPF crash. Documents indicate remote exploitation over the networ...

Palo Alto Networks Prisma SD-WAN ION 5.6.x / 6.1.x < 6.1.10 / 6.2.x / 6.3.x < 6.3.4 / 6.4.x < 6.4.2 / 6.5.0 Denial of Service (CVE-2025-0122)

The version of the remote Palo Alto Networks Prisma SD-WAN ION device is 5.6.x, 6.1.x prior to 6.1.10, 6.2.x, 6.3.x prior to 6.3.4, 6.4.x prior to 6.4.2, or 6.5.0. It is, therefore, affected by a denial of service vulnerability: - A denial-of-service DoS vulnerability in Palo Alto Networks Prisma...