PT-2026-121924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the PFCP Packet Forwarding Control Protocol implementation where pfcp encap recv fails to ensure that the 8-byte Session Endpoint Identifier SEID is in the linear area...

PT-2026-116700

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...

PT-2026-116800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc llcp recv dm nfc llcp recv dm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connecting sockets: it looks the socket up with nfc llcp connecting sock get...

PT-2026-116819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm recv frame While rfcomm recv frame verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field !...

PT-2026-116950

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: fix plen overflow in btintel pcie recv frame plen is u16 and computed as HDR SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check a...

PT-2026-116701

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...

SUSE CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

DEBIAN-CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

EUVD-2026-101043

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

UBUNTU-CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

PT-2026-114373

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A busy-wait condition occurs in the unix stream read generic function when recv0, MSG PEEK is called. This happens if the recv call is blocking and the final socket buffer skb in the que...

cve-2024-58239

exploit de mitigación CVE-2024-58239 Este es mi primer exploit de 1 día. Parche: tls: stop recv if initial processrxlist gave us non-DATA Vi exp407 en la hoja de cálculo de kernelCTF e intenté reproducir el exploit. Logré ejecutar el exploit en el entorno de kernelCTF y obtuve la bandera: Escribi...

PT-2026-106567

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An out-of-bounds read exists in the t7xx ccmni recv skb function. The netif index in the DPMAIF PIT header is five bits wide, allowing values up to 31, while the ccmni inst array only...

PT-2026-106146

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the wpas handle robust av scs recv action function within robust av.c allows for a possible out-of-bounds write. This condition could enable...

PT-2026-114150

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An infinite loop exists in the http response recv function. A malicious gateway can cause client CPU exhaustion by sending crafted Content-Type headers. Specifically, if a gateway returns a...

PT-2026-98649

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the af unix module where blocking recvMSG PEEK calls can lead to high CPU usage. This occurs because the manage oob function may skip Out-of-Band OOB socket buffers sk...

PT-2026-104971

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm recv frame rfcomm recv frame casts skb-data to struct rfcomm hdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than t...

PT-2026-105006

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap recv frame currently reads that PSM unconditionally after validating only the outer L2CAP...