c-copy-fail

CopyFail CVE-2026-31431 in Linux Kernel Crypto API Resources: main website aarch64 syscalls pwntools for generating shell code how ancillary data work in sendmsg...

CVE-2026-31431

CVE-2026-31431 Copy Fail - CVE-2026-31431 Detail https://nvd.nist.gov/vuln/detail/CVE-2026-31431 https://copy.fail/exploit https://xint.io/blog/copy-fail-linux-distributions Tested Distro / Version Distro| Version ---|--- Ubuntu 24.04 LTS| 6.17.0-1007-aws Amazon Linux 2023| 6.18.8-9.213.amzn2023...

CVE-2026-31431-mitigacion

CVE-2026-31431 — Complete Technical Analysis Classification: Local Privilege Escalation LPE — Linux Kernel CVSS: 7.8 High Impact: unprivileged user → root Affected module: algifaead AFALG kernel subsystem Table of Contents 1. Why is it vulnerable? 2. Which versions are affected? 3. How it is...

PT-2026-123355

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: rds: ib: reject FRMR registration before IB connection is established rdsibgetmr extracts the rdsibconnection from conn-ctransportdata and passes it to rdsibregfrmr for FRWR memory registration. On a fresh outgoing connection, ic...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg - fix NULL pointer dereference in scatterwalk The AFALG interface fails to unmark the end of a Scatter/Gather List SGL when chaining a new afalgtsgl structure. If a sendmsg fills an SGL exactly to MAXSGLENTS, the...

CVE-2026-98846

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCVSHUTDOWN after the sendmsg connect wait sctpwaitforconnect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent...

PT-2026-128530

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV SHUTDOWN after the sendmsg connect wait sctp wait for connect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurre...

PT-2026-117065

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where sctp wait for connect drops the socket lock during sleep. This allows an ABORT to be processed from the socket backlog and unlink the...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx-numdescs off-by-one error Unfortunately, the commit fd8958efe877 introduced another error that causes the descs array to overflow. This results in further crashes that are easily reproducible via the sendms...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: kcm: Fixed error handling for SOCKDGRAM in kcmsendmsg. Syzkaller identified a memory leak in kcmsendmsg, and the commit c821a88bd720 "kcm: Fix memory leak in the error path of kcmsendmsg" suppressed this issue by updating...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len = INTMAX - transhdrlen, ulen = len + transhdrlen will cause an overflow. To fix this, we can follow what udpv6 does by subtracting the transhdrlen from the max value...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in ip,6appenddata Including the transhdrlen in the length is problematic when the packet is partially filled for example, if something like sendMSGMORE occurred earlier when appending to an...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix locking in rxrpc’s sendmsg Fix three bugs in the rxrpc’s sendmsg implementation: 1 rxrpcnewclientcall should release the socket lock when returning an error from rxrpcgetcallslot. 2 rxrpcwaitfortxwindowintr will return...

Astra Linux – vulnerability in linux-5.10, linux

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix a memory leak in tcpbpfsendmsg when sk msg is full If tcpbpfsendmsg is running while sk msg is full. When skmsgalloc returns an -ENOMEM error, tcpbpfsendmsg proceeds to waitformemory. If partial memory has been...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: llc: make llcuisendmsg more robust against bonding changes syzbot was able to trick llcuisendmsg, allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header 1 Like some others, llcuisendmsg...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vccsendmsg atmarpddevops does not implement the send method, which may cause a crash as described below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops:...

ROS-20261009-73-0015

The vulnerability of the sendmsg function in the Linux operating system’s kernel is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to trigger a service failure...

pppoeject

PPPoEject — Linux kernel PPPoE use-after-free tracking site Source for the PPPoEject patch-status tracker: a single-page site recording which distributions have shipped a fix for the PPPoE sendmsg stale skb-head use-after-free in the Linux kernel. Where the facts live Everything about the bug — t...

PT-2026-94399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where devmem TX is not properly enforced to require zero-copy when NETIF F SG is absent. In such scenarios, the tcp sendmsg locked function...