cve-2024-58239

exploit de mitigación CVE-2024-58239 Este es mi primer exploit de 1 día. Parche: tls: stop recv if initial processrxlist gave us non-DATA Vi exp407 en la hoja de cálculo de kernelCTF e intenté reproducir el exploit. Logré ejecutar el exploit en el entorno de kernelCTF y obtuve la bandera: Escribi...

PT-2026-97983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth RFCOMM component where the rfcomm recv frame function casts skb-data to struct rfcomm hdr and dereferences hdr-addr and hdr-ctrl without first validating...

PT-2026-98042

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap recv frame currently reads that PSM unconditionally after validating only the outer L2CAP...

PT-2026-93395

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the GPRS Tunneling Protocol GTP implementation. The gtp newlink function error path frees tid hash and addr hash without waiting for a Read-Copy-Update R...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media: rc: gpio-ir-recv: added/removed functions If runtime PM is enabled, perform runtime PM cleanup to remove the cpu latency QoS request. Otherwise, driver removal may result in the following kernel dump: 19.463299 Unable t...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: Fixed the issue where load values were being altered in sk-skstamp during sockrecvcmsgs. KCSAN identified a data race in sockrecvcmsgs, where the read access to sk-skstamp requires using READONCE. BUG: KCSAN: Data race in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fixed a potential buffer overflow in i2chidgetreport i2chidxfer is used to read recvlen + sizeofle16 bytes of data into ihid-rawbuf. The former can originate from the user space of the hidraw driver and is bounded b...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btmtksdio: fixed a use-after-free in btmtksdiorecvevent We should no longer access the skb buffer data after the hcirecvframe function is called. 39.634809 BUG: KASAN: use-after-free in btmtksdiorecvevent+0x1b0...

PT-2026-90116

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An out-of-bounds access issue exists in the net/smc component during the handling of SMC-Rv2 LLC messages. On links where the device has max recv sge set to 1, there is no shared v2 receive...

CVE-2026-85440: Out-of-bounds Write

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo and negative size conversi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: virtio/vsock: Fixed an uninit-value issue in virtiotransportrecvpkt KMSAN reported the following uninit-value access issues: ===================================================== BUG: KMSAN: uninit-value in...

PT-2026-80499

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg tls server recv hello, which uses an attacker-controlled session id len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote,...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-67191

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-67191

Xlight FTP Server prior to 3.9.5 is affected by a pre-authentication heap buffer overflow in the SSH parser. A logic error in the recv loop termination (OR instead of AND) enables exploitation on any SSH or SFTP connection before authentication, allowing remote unauthenticated access with high im...

CVE-2026-67191: Heap-based Buffer Overflow

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

PT-2026-65836

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

EUVD-2026-48374

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

CVE-2026-59139

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...

CVE-2026-59139 Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...