Количество 21
Количество 21
CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as ...
CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as ...
CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_n
CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: R ...
ROS-20260930-80-0067
Уязвимость kernel-lt
ROS-20260930-73-0052
Уязвимость kernel-lt
GHSA-mhgq-v2h6-4f9w
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->sk...
RLSA-2026:74133
Moderate: kernel security, bug fix, and enhancement update
ELSA-2026-74133
ELSA-2026-74133: kernel security, bug fix, and enhancement update (MODERATE)
RLSA-2026:72623
Important: kernel security, bug fix, and enhancement update
ELSA-2026-72623
ELSA-2026-72623: kernel security, bug fix, and enhancement update (IMPORTANT)
ALT-PU-2026-8600
ALT-PU-2026-8600: package `kernel-image-std-def` update to version 5.10.258-alt1
ALT-PU-2026-8598
ALT-PU-2026-8598: package `kernel-image-un-def` update to version 6.1.175-alt1
SUSE-SU-2026:4254-1
Security update for the Linux Kernel
SUSE-SU-2026:4120-1
Security update for the Linux Kernel
ALT-PU-2026-8628
ALT-PU-2026-8628: package `kernel-image-6.18` update to version 6.18.34-alt1
ALT-PU-2026-9890
ALT-PU-2026-9890: package `kernel-image-rpi-un` update to version 6.12.94-alt1
openSUSE-SU-2026:21910-1
Security update for the Linux Kernel
ALT-PU-2026-9892
ALT-PU-2026-9892: package `kernel-image-6.12` update to version 6.12.94-alt1
ALT-PU-2026-11671
ALT-PU-2026-11671: package `kernel-image-rt` update to version 6.12.98-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-64102 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as ... | CVSS3: 9.8 | 1% Низкий | 3 месяца назад |
 | CVE-2026-64102 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as ... | CVSS3: 7 | 1% Низкий | 3 месяца назад |
 | CVE-2026-64102 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_n | CVSS3: 9.8 | 1% Низкий | 3 месяца назад |
| CVE-2026-64102 In the Linux kernel, the following vulnerability has been resolved: R ... | CVSS3: 9.8 | 1% Низкий | 3 месяца назад |
 | ROS-20260930-80-0067 Уязвимость kernel-lt | CVSS3: 9.8 | 1% Низкий | 13 дней назад |
| ROS-20260930-73-0052 Уязвимость kernel-lt | CVSS3: 9.8 | 1% Низкий | 13 дней назад |
| GHSA-mhgq-v2h6-4f9w In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->sk... | CVSS3: 9.8 | 1% Низкий | 3 месяца назад |
 | RLSA-2026:74133 Moderate: kernel security, bug fix, and enhancement update | 12 дней назад | ||
| ELSA-2026-74133 ELSA-2026-74133: kernel security, bug fix, and enhancement update (MODERATE) | 11 дней назад | ||
| RLSA-2026:72623 Important: kernel security, bug fix, and enhancement update | 13 дней назад | ||
| ELSA-2026-72623 ELSA-2026-72623: kernel security, bug fix, and enhancement update (IMPORTANT) | 14 дней назад | ||
| ALT-PU-2026-8600 ALT-PU-2026-8600: package `kernel-image-std-def` update to version 5.10.258-alt1 | CVSS3: 9.8 | 4 месяца назад | |
| ALT-PU-2026-8598 ALT-PU-2026-8598: package `kernel-image-un-def` update to version 6.1.175-alt1 | CVSS3: 9.8 | 4 месяца назад | |
 | SUSE-SU-2026:4254-1 Security update for the Linux Kernel | 26 дней назад | ||
| SUSE-SU-2026:4120-1 Security update for the Linux Kernel | около 1 месяца назад | ||
| ALT-PU-2026-8628 ALT-PU-2026-8628: package `kernel-image-6.18` update to version 6.18.34-alt1 | CVSS3: 10 | 4 месяца назад | |
| ALT-PU-2026-9890 ALT-PU-2026-9890: package `kernel-image-rpi-un` update to version 6.12.94-alt1 | CVSS3: 10 | 4 месяца назад | |
| openSUSE-SU-2026:21910-1 Security update for the Linux Kernel | 21 день назад | ||
| ALT-PU-2026-9892 ALT-PU-2026-9892: package `kernel-image-6.12` update to version 6.12.94-alt1 | CVSS3: 10 | 4 месяца назад | |
| ALT-PU-2026-11671 ALT-PU-2026-11671: package `kernel-image-rt` update to version 6.12.98-alt1 | CVSS3: 10 | 2 месяца назад |
Уязвимостей на страницу