Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: tipc: The issue in tipcnlcompatnametabledumpheader regarding the check of the msg-req TLV length was fixed. This is a follow-up to commit 974cb0e3e7c9 “tipc: fixing uninit-value in tipcnlcompatnametabledump", where a type cast fr...

lldp

lldp Perfil C2 de Mythic para comunicación peer-to-peer a través de IEEE 802.1AB LLDP. Los datos C2 se transportan dentro de TLVs específicos de organización Tipo 127 con un OUI configurable, de modo que las tramas se mezclen con las extensiones LLDP específicas del proveedor en la red. LLDP es...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

AZL-99657 CVE-2026-80799 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

AZL-99596 CVE-2026-80800 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80800

CVE-2026-80800 affects the Linux kernel NFC LLCP subsystem. The function nfc_llcp_connect_sn() walks a TLV list without validating that the two-byte header or declared length stay within the skb buffer, and computes tlv_array_len as skb->len - LLCP_HEADER_SIZE in size_t, causing an underflow f...

EUVD-2026-71235

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80800 nfc: llcp: bound the connect_sn TLV walk to the skb

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80799 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

CVE-2026-80799

CVE-2026-80799 affects the Linux kernel NFC LLCP subsystem, specifically the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() TLV parsers. Three related bugs exist: (1) an u8 offset that silently wraps to zero when TLV data exceeds 255 bytes, causing infinite loops; (2) a missing bound...

CVE-2026-80799

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

EUVD-2026-71234

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

EUVD-2026-71441

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...

Linux Distros Unpatched Vulnerability : CVE-2026-80800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e nfc: llcp: bound SNL TLV parsing to the skb and add length checks fixed the unbounded TLV...

Linux Distros Unpatched Vulnerability : CVE-2026-80799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops:...

SUSE CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

EUVD-2026-66557

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...