POC-2020-8558

Overview CVE-2020-8558 is a Kubernetes venerability which was published because kube-proxy unexpectedly makes localhost-bound host services available to others on the network. I place the emphasis on unexpectedly because this vulnerability is due to a design flaw oversight, not an implementation...

opnsense-tunables-loader

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-tunables-loader opnsense-tunables-loader Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org System: Advanced: Tunables still interpolates name/value into /boot/loader.conf...

Linux Distros Unpatched Vulnerability : CVE-2026-98434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sysctl: Check range in procdointvecmsjiffiesminmax Add the range check to doprocintconvmsjiffiesminmax that commit d174174c6776 sysctl: replace...

Linux Distros Unpatched Vulnerability : CVE-2026-98530

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes- optimization while a kprobe is jump-optimized never returns...

kernel: sctp: avoid auth_enable sysctl UAF during netns teardown

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This Use-After-Free UAF vulnerability occurs during network namespace netns teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a...

CVE-2026-98434

A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission to modify kernel parameters could provide out-of-bounds...

webhook-cve-2022-0811

webhook-cve-2022-0811 This is a really simple webhook that just blocks pod creation if malicious sysctl values are configured. Build go test CGOENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build Build image an deploy in Minikube Start minikube: minikube start minikube addons enable registr...

UBUNTU-CVE-2026-98434

In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in procdointvecmsjiffiesminmax Add the range check to doprocintconvmsjiffiesminmax that commit d174174c6776 "sysctl: replace SYSCTLINTCONVCUSTOM macro with functions" incorrectly removed...

CVE-2026-98434

In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in procdointvecmsjiffiesminmax Add the range check to doprocintconvmsjiffiesminmax that commit d174174c6776 "sysctl: replace SYSCTLINTCONVCUSTOM macro with functions" incorrectly removed...

PT-2026-116749

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe sysctl mutex held, ...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ICMP: Fixed data races related to sysctlicmpechoenableprobe. When reading sysctlicmpechoenableprobe, it can be changed concurrently. Therefore, we need to add READONCE to its readers...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sysctl: Always initialize iuid/igid. iuid/igid is always initialized within the sysfs core, so setownership can safely skip setting them. The commit 5ec27ec735ba from “fs/proc/procsysctl.c: fix the default values of iuid/igid on...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ip: Fixed a data race around the sysctlfwmarkreflect function. When reading sysctlfwmarkreflect, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: ipv4: Issues with TCP reordering of sysctl writes and MTU probe sizes were addressed. Invalid values of net.ipv4.tcpreordering are now rejected before they reach the TCP socket state. The sysctl value is stored as an int...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpprobeinterval. When reading sysctltcpprobeinterval, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: udplite: Fixed a NULL pointer dereference in skmemraiseallocated. syzbot reported a NULL pointer dereference in skgetrmem0 while using IPPROTOUDPLITE 0x88: 14:25:52 executing program 1: r0 = socket$inet60xa, 0x80002, 0x88 We...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipfwdupdatepriority. When reading sysctlipfwdupdatepriority, it can be changed concurrently. Therefore, we need to add READONCE to its readers...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpearlyretrans. When reading sysctltcpearlyretrans, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipfwdusepmtu. When reading from sysctlipfwdusepmtu, it can be changed concurrently. Therefore, we need to add a READONCE call to its readers...