Vulnerability intelligence

CVE-2026-74469, also known as "DiagSpill," is an integer overflow vulnerability found within the Stream Control Transmission Protocol (SCTP) implementation of the Linux kernel. The flaw specifically resides in the `sctp_assoc_add_peer` function. This function is responsible for incrementing a 16-bit `transport_count` for each new unique peer associated with an SCTP connection. The vulnerability occurs when a local attacker with low privileges manipulates the system to cause the `transport_count` to exceed its 16-bit limit, leading to an integer overflow where the count wraps back to zero. When this happens, the SCTP `sock_diag` diagnostic reporting mechanism reserves an insufficient amount of memory for the `INET_DIAG_PEERS` payload. Consequently, when peer transport data is copied, it results in an out-of-bounds write of approximately 8 MB of data past the allocated socket buffer (skb) tail, leading to memory corruption.

CVE-2026-81000, dubbed "TUNderflow," is an integer underflow vulnerability found within the Linux kernel's TUN/TAP driver. Specifically, the flaw resides in the `tun_get_user()` function, which is responsible for handling receive headroom requests. This issue arises when the system processes an oversized headroom request, particularly if Open vSwitch (OVS) propagates an excessively large request to a TUN or TAP device. The vulnerability can lead to memory corruption, where network packet data is written beyond its allocated buffer. This out-of-bounds write can result in unintended system behavior or instability.

CVE-2026-68121, also known as "PPPoEject," is a use-after-free vulnerability found within the Linux kernel's Point-to-Point Protocol over Ethernet (PPPoE) implementation. The flaw arises in the `pppoe_sendmsg()` function, where a pointer to the PPPoE header is saved prior to invoking `dev_hard_header()`. Device header callbacks have the capability to reallocate the socket buffer (skb) head, which can invalidate any previously stored pointers. If the skb head is reallocated, the PPPoE implementation subsequently writes six bytes through the now-stale pointer into memory that has already been freed. This action can lead to kernel memory corruption. The vulnerability was discovered by researcher Asim Viladi Oglu Manizada and is one of several local privilege escalation (LPE) flaws recently identified in the Linux kernel.

CVE-2025-39682 is a vulnerability found in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw specifically affects the handling of zero-length records within the `rx_list` during the `recvmsg()` process. This issue arises from a corner case where an initial zero-length record, pulled from the `rx_list`, disrupts assumptions made by the `recvmsg()` logic regarding zero-copy decryption and transitions between record types. This mishandling can lead to memory corruption and a use-after-free condition within the kernel's TLS receive path. A local, authenticated user can exploit this vulnerability by crafting a specific TLS traffic pattern that leaves a zero-length record queued on the `rx_list`, subsequently triggering the vulnerable code path during a `recvmsg()` call.

CVE-2026-53266 is a vulnerability found in the Linux kernel's netfilter bridge subsystem, specifically within the `ebt_snat` (Ethernet Bridge Source Network Address Translation) target. The flaw occurs in the optional ARP sender hardware address (SHA) rewrite path. The kernel function `skb_store_bits()` is called to write into the socket buffer (skb) without first verifying that the target memory range is writable. This oversight can lead to memory corruption. When the ARP SHA range resides in a nonlinear skb fragment that is backed by a splice-imported file page, the write operation directly modifies the underlying page. This unauthorized modification can corrupt memory belonging to other kernel objects or user-space mappings. A local attacker capable of configuring `ebtables` rules and crafting specific packets can trigger this unsafe write.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.