CVE-2026-31431-mitigacion

CVE-2026-31431 — 完整技术分析 分类： 本地权限提升（LPE）— Linux 内核 CVSS： 7.8（高危） 影响： 无特权用户 → root 受影响模块： algifaead（内核 AFALG 子系统） 目录 1. 为什么存在漏洞？ 2. 哪些版本受影响？ 3. 如何利用 4. 如何缓解 1. 为什么存在漏洞？ AFALG 子系统 Linux 内核向用户空间暴露了一个名为 AFALG （AFALG 套接字族）的加密接口。该接口允许无特权进程使用内核的加密加速器——加密、哈希、密钥生成——而无需 root 权限。 其中一个模块是 algifaead ，它实现了 AEAD...

c-copy-fail

CopyFail Linux 커널 Crypto API의 CVE-2026-31431 리소스: 메인 웹사이트 aarch64 시스템 콜 셸 코드 생성을 위한 pwntools sendmsg 에서 보조 데이터가 작동하는 방식...

CVE-2026-31431

CVE-2026-31431 Copy Fail - Детали CVE-2026-31431 https://nvd.nist.gov/vuln/detail/CVE-2026-31431 https://copy.fail/exploit https://xint.io/blog/copy-fail-linux-distributions Протестированные дистрибутивы / Версии Дистрибутив| Версия ---|--- Ubuntu 24.04 LTS| 6.17.0-1007-aws Amazon Linux 2023|...

CVE-2026-80889 can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and txgen ordering This patch is a follow-up to commit cf070fe33bfb "can: isotp: serialize TX state transitions under so-rxlock" which addresses following sashiko-bot findings: -...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed an issue of signed integer overflow in l2tpip6sendmsg. When len = INTMAX - transhdrlen, the value of ulen = len + transhdrlen will cause an overflow. To address this issue, we can follow the approach used by udpv6 and...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: IB/hfi1: Fixed the off-by-one error in sdma.h’s tx-numdescs. Unfortunately, the commit fd8958efe877 introduced another error, causing the descs array to overflow. This leads to further crashes that can be easily reproduced usi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: kcm: Fixed error handling for SOCKDGRAM in kcmsendmsg. Syzkaller identified a memory leak in kcmsendmsg, and the commit c821a88bd720 "kcm: Fix memory leak in the error path of kcmsendmsg" suppressed this issue by updating...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv4, ipv6: Fixed the handling of transhdrlen in ip,6appenddata. Including transhdrlen in the packet length is a problem when the packet is partially filled e.g., a sendMSGMORE operation occurred previously when appending to a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - rxrpc: Fixed the locking mechanism in rxrpc’s sendmsg function. - Three bugs were fixed in the implementation of rxrpc’s sendmsg function: 1 The rxrpcnewclientcall function should release the socket lock when returning an...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed a memory leak in tcpbpfsendmsg when skmsg is full. If tcpbpfsendmsg is running while skmsg is full, and skmsgalloc returns an -ENOMEM error, tcpbpfsendmsg will enter a waitformemory state. If part of the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: llc: Makes llcuisendmsg more robust against changes to bonding. syzbot was able to exploit llcuisendmsg, allocating a skb without sufficient headroom, and then attempting to append 14 bytes of Ethernet header information. Like...

Linux Distros Unpatched Vulnerability : CVE-2026-72124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a...

EUVD-2026-57069

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234

The CVE affects Zephyr’s userspace networking verification on zsock_sendmsg/zsock_recvmsg. The issue is a TOCTOU double-fetch: the verifier snapshots struct net_msghdr, yet later re-reads the live user memory to bound the loop, allowing a race where msg_iovlen can be inflated after the shadow buf...

CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

EUVD-2026-55385

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68284

CVE-2026-68284 affects the Linux kernel BPF/sockmap path. The bug is a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket: msg_tx is compared to psock->cork while cork may have been freed, leading to freeing a stale cork. A fix ensures tmp cork is checked directly, pr...

apparmor: mediate the implicit connect of TCP fast open sendmsg

...

CVE-2026-63828

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection in the SYN. apparmorsocketsendmsg only checks AAMAYSEND, so a profil...

EUVD-2026-45494

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection in the SYN. apparmorsocketsendmsg only checks AAMAYSEND, so a profil...