Astra Linux – Vulnerability in Linux 5.15

The Linux kernel’s NFSD implementation before versions 5.19.17 and 6.0.2 is vulnerable to buffer overflow attacks. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call RPC into a single array of pages. A client can force the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Do not accept ACKs for bytes that we never sent. This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. The validation of ACK sequences currently follows the guidelines outlined in RFC 5961,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialize rcvmss before calling tcpsendactivereset in mptcpdofastclose. syzbot reported a divide-by-zero issue in tcpselectWindow for MPTCP sockets. 0 We had a similar issue with bare TCP and fixed it in commit 499350a5a6...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tcp: tcprtxsynack can be called from process context Laurent reported the enclosed report 1 This bug triggers under the following conditions: 0 The kernel is built with CONFIGDEBUGPREEMPT=y 1 A new passive FastOpen TCP socket is...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: TCP: Added sanity tests to TCPQUEUESEQ Qingyu Li reported a syzkaller bug where the repro function changed the RCV SEQ after restoring data in the receive queue. mprotect0x4aa000, 12288, PROTREAD = 0 mmap0x1ffff000, 4096, PROTNON...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A out-of-bounds read vulnerability was discovered in the NVMe-oF/TCP subsystem within the Linux kernel. This issue may allow a remote attacker to send a specially crafted TCP packet, triggering a heap-based buffer overflow. As a result, data from kmalloc will be printed, and it may also be leaked...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

A vulnerability was identified in the Linux Kernel versions up to 4.19.316/5.4.278/5.10.220/5.15.161. This affects the tcpgetsockopt/tcpsetsockopt functions of the TCP Handler component. Such manipulation leads to a race condition. This attack involves a high level of complexity. The vulnerabilit...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: added accessors to read/set tp-sndcwnd. Over the years, we’ve had various bugs in the code that broke the assumption that tp-sndcwnd is greater than zero. Recently, syzbot reported that the condition WARNONONCE!tp-priorcwnd...

Astra Linux – Vulnerability in connman

A issue was discovered in the DNS proxy of Connman through version 1.40. The implementation of the TCP server’s reply mechanism lacks a check to ensure that there is sufficient Header Data, resulting in an out-of-bounds read...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mptcp: A stricter state check has been added in mptcpworker. According to Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: c connect // Incoming reset + fastclose // The mpt...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fixed an out-of-bounds condition during the parsing of TCP options. The TCP option parser in mptcp mptcpgetoptions could read one byte out of bounds. When the length of the option is 1, the execution flow enters a loop,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In tcpconnrequest, do not call reqskfastopenremove. The syzbot reported the following issue in tcpconnrequest: 0 If a listener is closed while a TFO socket is being processed in tcpconnrequest, inetcskreqskqueueadd does not set...

CVE-2026-68119 tcp: initialize standalone TCP-AO response padding

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

CVE-2026-64575

A flaw was found in the Linux kernel. A double release of socket resources can occur during batch reallocation in the BPF Berkeley Packet Filter TCP iterator. A local attacker could exploit this vulnerability to trigger a kernel panic. This leads to a system crash, resulting in a Denial of Servic...

CVE-2026-64575

CVE-2026-64575 affects the Linux kernel’s BPF TCP iterator. The issue is a double release of socket resources during batch reallocation in bpf_iter_tcp_batch, where on realloc failure the code returns ERR_PTR() and leaves cur_sk

CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-45103 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-61514

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field i...

Exploit for Classic Buffer Overflow in Rsyslog

CVE-2022-24903 Hands-On Lab Author: Andrew Beshay Mousa...

CVE-2026-64422

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...