Vulnerability intelligence

CVE-2025-39682 is a vulnerability found in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw specifically affects the handling of zero-length records within the `rx_list` during the `recvmsg()` process. This issue arises from a corner case where an initial zero-length record, pulled from the `rx_list`, disrupts assumptions made by the `recvmsg()` logic regarding zero-copy decryption and transitions between record types. This mishandling can lead to memory corruption and a use-after-free condition within the kernel's TLS receive path. A local, authenticated user can exploit this vulnerability by crafting a specific TLS traffic pattern that leaves a zero-length record queued on the `rx_list`, subsequently triggering the vulnerable code path during a `recvmsg()` call.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.

CVE-2026-53266 is a vulnerability found in the Linux kernel's netfilter bridge subsystem, specifically within the `ebt_snat` (Ethernet Bridge Source Network Address Translation) target. The flaw occurs in the optional ARP sender hardware address (SHA) rewrite path. The kernel function `skb_store_bits()` is called to write into the socket buffer (skb) without first verifying that the target memory range is writable. This oversight can lead to memory corruption. When the ARP SHA range resides in a nonlinear skb fragment that is backed by a splice-imported file page, the write operation directly modifies the underlying page. This unauthorized modification can corrupt memory belonging to other kernel objects or user-space mappings. A local attacker capable of configuring `ebtables` rules and crafting specific packets can trigger this unsafe write.

CVE-2025-39682 is a vulnerability found in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw specifically affects the handling of zero-length records within the `rx_list` during the `recvmsg()` process. This issue arises from a corner case where an initial zero-length record, pulled from the `rx_list`, disrupts assumptions made by the `recvmsg()` logic regarding zero-copy decryption and transitions between record types. This mishandling can lead to memory corruption and a use-after-free condition within the kernel's TLS receive path. A local, authenticated user can exploit this vulnerability by crafting a specific TLS traffic pattern that leaves a zero-length record queued on the `rx_list`, subsequently triggering the vulnerable code path during a `recvmsg()` call.

CVE-2026-53266 is a vulnerability found in the Linux kernel's netfilter bridge subsystem, specifically within the `ebt_snat` (Ethernet Bridge Source Network Address Translation) target. The flaw occurs in the optional ARP sender hardware address (SHA) rewrite path. The kernel function `skb_store_bits()` is called to write into the socket buffer (skb) without first verifying that the target memory range is writable. This oversight can lead to memory corruption. When the ARP SHA range resides in a nonlinear skb fragment that is backed by a splice-imported file page, the write operation directly modifies the underlying page. This unauthorized modification can corrupt memory belonging to other kernel objects or user-space mappings. A local attacker capable of configuring `ebtables` rules and crafting specific packets can trigger this unsafe write.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.