These trackers are archived — updates have ended, as every tracked release has a fix or no remaining row is expected to change. Active trackers are on the front page.
skb->data past its page-sized head. An unprivileged local user (via
user namespaces) or a container holding CAP_NET_ADMIN escalates to root,
and a working exploit is public. One of four bugs disclosed together with DirtyAH6,
PPPoEject, and DiagSpill.
ipv6_rearrange_rthdr() mishandles a routing header's
segments_left, so a crafted packet writes past the socket-buffer head. An
unprivileged local user or a container with CAP_NET_ADMIN escalates to
root. One of four bugs disclosed with TUNderflow, PPPoEject, and DiagSpill.
sctp_diag heap overflow: an association's 16-bit peer
transport count wraps at 65,536 peers, so a diagnostic dump reserves nothing but
copies the full list, spilling ~8 MiB past the Netlink buffer. Unlike its three
siblings it needs no user namespace and no capability — any local user with the
sctp and sctp_diag modules available escalates to root. One
of four bugs disclosed together with DirtyAH6, TUNderflow, and PPPoEject.
tc flower filters with
a police action race the unserialized global qdisc rate-table list and refcount on an
unlocked classifier path, freeing a rate table still in use. An unprivileged local
user (via user namespaces) or a container holding CAP_NET_ADMIN escalates
to root, and a working exploit is public.
pppoe_sendmsg() keeps a pointer into
the socket-buffer head across the lower device's header callback, which can reallocate
and free that head, so the PPPoE header write lands in freed memory. An unprivileged
local user (via user namespaces) or a container holding
CAP_NET_ADMIN escalates to root, and a working exploit is public. One of
four bugs disclosed together with DirtyAH6, TUNderflow, and DiagSpill.
/dev/kvm is world-accessible an unprivileged local user can trigger it
too.
nla_len, letting an unprivileged local user escalate to
root on hosts running the OVS datapath with conntrack.
__ip6_append_data() corrupts adjacent memory, enabling an unprivileged
container escape and local privilege escalation.
/dev/kvm is world-accessible.
--snat-arp rewrite
stores a MAC address into whatever page backs the ARP payload, so a splice-imported
file page receives six attacker-chosen bytes — a Dirty Pipe-class primitive.
Needs CAP_NET_ADMIN over a bridge (user namespaces). Fixed upstream in
June 2026; added to CISA KEV on 2026-09-18 as exploited in the wild.
remove_waiter(), giving any unprivileged local user root — and an
unprivileged container an escape to the host.
map
clobbers the PCRE captures, so a capture referenced before the map's variable in the
same expression makes the sizing and writing passes disagree — giving an
unauthenticated attacker both an overflow and a heap-pointer leak, and with them
pre-authentication remote code execution.
sendmsg() calls on
one socket corrupt the per-socket scatterlist in af_alg_sendmsg(), giving
a kernel out-of-bounds read and write. Any unprivileged local user can reach it
— no capability or namespace needed — and a public exploit escalates to
root. Fixed upstream in September 2025; added to CISA KEV on 2026-09-18 as exploited
in the wild.
tls_sw_recvmsg() mishandles a zero-length record taken from
rx_list, so a remote TLS peer can make the kernel free receive buffers
still in use — kernel memory disclosure, write-after-free, and a remote crash on
any host with kernel TLS attached. Fixed upstream in August 2025 and added to CISA's
KEV catalog on 2026-09-18.