DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone When Shared Memory Stops Being Shared Safely. A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFLSHAREDFRAG flag inside the Linux networking stack. 📖 Overview CVE-2026-43503 , nicknamed DirtyClone , is a High Severity Local Privileg...

CVE-2026-64563_EXP

CVE-2026-64563EXP Solo per ricerca sperimentale. Il codice di prefetch e nperm richiede il riferimento di memoria impostato da set.gdb non è allegato; non essendo stato ottimizzato, la probabilità di successo è bassa. L'autore ha notato che l'autore della vulnerabilità ha già pubblicato le...

AZL-98114 CVE-2026-80681 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80601

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...

CVE-2026-80612 net: lwtunnel: Drop skb metadata before LWT encapsulation

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612

This Linux kernel vulnerability affects the net lwtunnel (lightweight tunnel) subsystem. When LWT encapsulation prepends outer headers, it moves skb->data over the headroom where XDP/TC skb metadata resides. Non-BPF encaps types (MPLS, Seg6, IOAM6) silently overwrite this metadata via skb_push...

EUVD-2026-67488

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

CVE-2026-80612 net: lwtunnel: Drop skb metadata before LWT encapsulation

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

EUVD-2026-67477

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80601 batman-adv: gw: acquire ethernet header only after skb realloc

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

EUVD-2026-67476

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

CVE-2026-80600 affects the batman-adv module of the Linux kernel, specifically in the DAT (Distributed ARP Table) subsystem. The root cause is a use-after-free : when pskb_may_pull() is called by batadv_get_vid(), it may reallocate the buffer behind the skb, leaving variables that pointed to the ...

CVE-2026-80600 batman-adv: dat: acquire ARP hw source only after skb realloc

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...