71 matches found
ipv6_frag_escape
IPV6FRAGESCAPE A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10. It rides a now fixed IPv6 fragmentation bug in ip6appenddata closed upstream by 38becddc, no CVE, an in-slab linear overflow into the skbsharedinfo at the tail of a packet's own head object. This...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143075)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143075 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: A fix was made to prevent overflow of the skbsharedinfo-frags array when processing rxcomplete calls. A malicious USB device that claims to be a CDC Phonet modem can cause an overflow by sending an unbounded...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: xsk: The UMEM headroom validation has been improved to account for tailroom and minimum frame size. The current headroom validation in xdpumemreg might result in insufficient space being reserved for receiving Ethernet frames of...
Astra Linux – vulnerability in linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skbsharedinfo tailroom xdpfclone clones broadcast copies into a single page and sets framesz to PAGESIZE. xdpbuildskbfromframe later treats that page as a normal XDP frame and expects the usual...
Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clears skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, moves it into the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still retains the outer packet’s inet6skbparm in...
SUSE CVE-2026-98419
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
AZL-108162 CVE-2026-98419 affecting package kernel for versions less than 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
CVE-2026-98419
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
DEBIAN-CVE-2026-98419
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
UBUNTU-CVE-2026-98419
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
EUVD-2026-101068
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
CVE-2026-98419
The Linux kernel 's drop_monitor subsystem contains an out-of-bounds write vulnerability in the reset_per_cpu_data() function. The root cause is an incorrect buffer size calculation where al includes a 4-byte attribute header, causing memset() to write past the allocated buffer and corrupt skb_sh...
Linux kernel security vulnerabilities
A security vulnerability exists in the Linux kernel. It arises because the al variable in the resetpercpudata function contains sizeofstruct nlattr, resulting in an excessively small allocated buffer. When memset is called, 4 bytes beyond the allocated buffer are written, corrupting skbsharedinfo...
CVE-2026-98419
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
CVE-2026-98419: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...
Linux Distros Unpatched Vulnerability : CVE-2026-98419
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg %NASLMINLEVEL 80900 C Tenable,...
UBUNTU-CVE-2026-81002
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...