dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...

SG-2026-0024

Dirty Frag primitive-only PoC Readable N4C demonstrator for CVE-2026-43284 XFRM/ESP and CVE-2026-43500 RxRPC/RXKAD. The PoC answers one question: can an unprivileged process change the page cache of a root-owned, read-only file through a sharedskbuff fragment? It does not overwrite /usr/bin/su or...

CVE-2026-99010 Bluetooth: RFCOMM: free the skb when the DLC has no owner

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010

The Linux kernel Bluetooth RFCOMM component contains a memory leak vulnerability. The issue occurs in rfcomm_recv_data() when a Data Link Control (DLC) has no owner (e.g., after rfcomm_sock_destruct() clears d->owner but before the session closes). In the socket implementation, the skb is hand...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53184)

"In the Linux kernel, the following vulnerability has been resolved: udp: clear skb-dev before running a sockmap verdict On the UDP receive path skb-dev is repurposed as devscratch the truesize/state cache set by udpsetdevscratch, through the union struct netdevice dev; unsigned long devscratch; ...

Linux Distros Unpatched Vulnerability : CVE-2026-98541

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 fou: Don't allow 0 for FOUATTRIPPROTO. added NLAPOLICYMINNLAU8, 1 to...

SUSE CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

DEBIAN-CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

AZL-109124 CVE-2026-98541 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

UBUNTU-CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

EUVD-2026-103586

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

The Linux kernel contains a vulnerability where omitting the FOU_ATTR_IPPROTO attribute when sending a FOU_CMD_ADD request with FOU_ENCAP_DIRECT causes fou_create() to initialize the protocol to 0. Because fou_udp_recv() returns 0 when the protocol is 0, it informs the UDP tunnel layer that the s...

CVE-2026-98541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kcm: Fixed a memory leak in the error path of kcmsendmsg. The syzbot reported a memory leak as follows: BUG: Memory leak Unreferenced object 0xffff88810b088c00 size 240: Comm “syz-executor186”, pid 5012, jiffies 4294943306 age...

SUSE CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

DEBIAN-CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...