CVE-2026-98274

The Linux kernel contains a conflict between PSP and the TLS ULP regarding the usage of skb->decrypted and sk->sk_validate_xmit_skb(). To resolve this, PSP is made mutually exclusive with TLS ULP. The fix involves including all TCP ULPs in the sk_has_decrypt_user() check to close potential ...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone When Shared Memory Stops Being Shared Safely. A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFLSHAREDFRAG flag inside the Linux networking stack. 📖 Overview CVE-2026-43503 , nicknamed DirtyClone , is a High Severity Local Privileg...

pppoeject

PPPoEject — Linux kernel PPPoE use-after-free tracking site Source for the PPPoEject patch-status tracker: a single-page site recording which distributions have shipped a fix for the PPPoE sendmsg stale skb-head use-after-free in the Linux kernel. Where the facts live Everything about the bug — t...

SUSE SLES15 Security Update : kernel RT (Live Patch 20 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4434-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4434-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.75 fixes one security issue: The following security issue was fixed: - CVE-2026-74612:...

CVE-2026-64563_EXP

CVE-2026-64563EXP 실험 연구 전용이며, prefetch 및 nperm의 코드설정이 필요한 메모리 참조 set.gdb는 첨부되지 않았고, 최적화를 수행하지 않아 히트 확률이 낮습니다. 저자는 이 취약점의 작성자가 해당 취약점 관련 정보를 이미 공개했음을 확인했습니다: https://github.com/google/security-research/pull/414 이용 방식은 전혀 다릅니다. 해당 이용 방식을 완전히 검증하지 못했기 때문에 보수적인 입장을 유지합니다주로 sock 스핀락이 실제로 레이스 상태를 유발할 수...

Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.75 fixes one security issue: The following security issue was fixed: CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment bsc1277506. Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2026:4434-1 Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.75 fixes one security issue: The following security issue was fixed: - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment bsc1277506...

CVE-2026-31429-POC

CVE-2026-31429 — Linux 커널: bpfprogtestrunskb를 통한 KFENCE 할당 SKB 헤드의 교차 캐시 해제 심각도: 중간 CWE-763: 잘못된 포인터 또는 참조 해제 게시일: 2026-04-20 영향을 받는 서브시스템: net/core/skbuff.c — skbkfreehead 연구자: Antonius / w1sdom — Blue Dragon Security 연락처: [email protected] Lore 스레드:...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: It was discovered that nfqueue holds the bridgeskb-dev variable while the packet is being queued. The function brpassFrameup reassigns skb-dev from the ingress port to the bridge master before queuing bridge...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

AZL-104238 CVE-2026-97964 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-98089

The Linux kernel contains a vulnerability in the bonding driver's alb component. Specifically, the function alb_determine_nd() incorrectly uses icmp6_hdr(skb) to inspect ICMPv6 headers. In certain xmit paths, such as those using AF_PACKET or raw sockets , the skb->transport_header is not guara...

CVE-2026-97985

In the Linux kernel, the following vulnerability has been resolved: afunix: Update last skb marker in manageoob. Fahad Alharbi reported that blocking recvMSGPEEK could hog CPU due to OOB skb. In the following cases, manageoob skips OOB skbs and returns NULL for the last recvMSGPEEK:...

CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-97614

The Linux kernel contains a vulnerability in the net: dsa: tag_brcm component where the legacy FCS tagger fails to declare required tailroom. When a nonlinear skb reaches the tagger, it calculates the CRC over bytes starting at skb->data, causing it to read past the linear head into unrelated ...

CVE-2026-97614

In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...

Linux Distros Unpatched Vulnerability : CVE-2026-98050

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather...

Linux Distros Unpatched Vulnerability : CVE-2026-98097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length TIPCMAXIFNAME buffer. Replace the strcpydata, l-ifnam...