ScreenOff

ScreenOff CVE-2026-52910 kernel crash poc. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation what socket + SOATTACHREUSEPORTCBPF + setsockopt race. timerfd/epoll callback storm slows down the receive path. replace the cBPF filter while the old prog is still in...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock()

A flaw was found in the Linux kernel’s TLS implementation net/tls/tlsdevice.c. The function getnetdevforsock is invoked during setsockopt, which is not executed under RCU Read-Copy-Update protection. It previously used skdstgetsk-dev, which can lead to a use-after-free UAF if the sk’s destination...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: xsk: Validated user input for XDPUMEM|COMPLETIONFILLRING syzbot reported an illegal copy in xsksetsockopt 1 Ensure that the @optlen parameter of setsockopt is validated. 1 BUG: KASAN: Out-of-bounds access in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: SCO: Fixed issue where user input is not validated before calling setockopt. The syzbot reported that scosocksetsockopt copies data without checking the length of the user input. BUG: KASAN: Out-of-bounds access in...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

A vulnerability was identified in the Linux Kernel versions up to 4.19.316/5.4.278/5.10.220/5.15.161. This affects the tcpgetsockopt/tcpsetsockopt functions of the TCP Handler component. Such manipulation leads to a race condition. This attack involves a high level of complexity. The vulnerabilit...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fixed a UAF in j1939skmatchfilter during setsockoptSOJ1939FILTER. Locked jsk-sk to prevent UAF when setsockopt..., SOJ1939FILTER, ... modifies jsk-filters while receiving packets. The following issue was observed on t...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed an issue where user input was not validated. The length of user input was checked before data was copied...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: Validates user input to ensure it is of the expected length. I received multiple syzbot reports indicating that old bugs were exposed due to BPF after the commit 20f2505fb436 “bpf: Try to avoid kzalloc in...

PT-2026-79694

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc setsockopt vcc setsockopt contained an ineffective optlen check: if SO LEVEL MATCHoptname, level && optlen != SO SIZEoptname return -EINVAL; If SO LEVEL MATCHoptname, level evaluated to...

CVE-2026-49422

The FreeBSD advisory (FreeBSD-SA-26:43.tcp) confirms the bug affects all supported FreeBSD versions and provides specific correction commit hashes for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.4, and releng/14.3 branches, all dated 2026-06-30. Workarounds include not loading tcp_r...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-68387

In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 "can: raw: use bitfields to store flags in struct rawsock" the formerly separate integer values have been integrated into a single bitfield. This led to a...

CVE-2026-68387

The CVE-2026-68387 defect affects the Linux kernel CAN raw socket path. A change to store flags in a single bitfield (struct raw_sock) introduced a read-modify-write window during raw_setsockopt() flag updates, enabling concurrent access races. The fix adds a locking wrapper around flag manipulat...

EUVD-2026-55573

In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 "can: raw: use bitfields to store flags in struct rawsock" the formerly separate integer values have been integrated into a single bitfield. This led to a...

CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

CVE-2026-63871

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability, a data-race, occurs because certain functions access socket-related data without proper synchronization. Specifically, isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync can read critical fields while...

FreeBSD : FreeBSD -- Use-after-free in TCP RACK stack option handler (6c547c1b-74e2-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c547c1b-74e2-11f1-958d-bc241121aa0a advisory. The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, the...

FreeBSD-SA-26:43.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:43.tcp Security Advisory The FreeBSD Project Topic: Use-after-free in TCP RACK stack option handler Category: core Module: tcp Announced: 2026-06-30 Credits:...

FreeBSD -- Use-after-free in TCP RACK stack option handler

Problem Description: The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control...