Поиск уязвимостей
Количество 12
Количество 12
GHSA-6mmc-6x3m-rgjh
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
CVE-2026-98323
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
CVE-2026-98323
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
CVE-2026-98323
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
CVE-2026-98323
RDMA/siw: Bound fragmented header copies by the remaining length
CVE-2026-98323
In the Linux kernel, the following vulnerability has been resolved: R ...
SUSE-SU-2026:4937-1
Security update for the Linux Kernel
SUSE-SU-2026:4936-1
Security update for the Linux Kernel
SUSE-SU-2026:4934-1
Security update for the Linux Kernel
SUSE-SU-2026:4940-1
Security update for the Linux Kernel
SUSE-SU-2026:4935-1
Security update for the Linux Kernel
openSUSE-SU-2026:22167-1
Security update for the Linux Kernel
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-6mmc-6x3m-rgjh In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. | CVSS3: 9.8 | 1% Низкий | около 1 месяца назад |
 | CVE-2026-98323 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. | CVSS3: 9.8 | 1% Низкий | около 1 месяца назад |
 | CVE-2026-98323 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. | CVSS3: 7 | 1% Низкий | около 1 месяца назад |
 | CVE-2026-98323 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. | CVSS3: 9.8 | 1% Низкий | около 1 месяца назад |
 | CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length | CVSS3: 9.8 | 1% Низкий | около 1 месяца назад |
| CVE-2026-98323 In the Linux kernel, the following vulnerability has been resolved: R ... | CVSS3: 9.8 | 1% Низкий | около 1 месяца назад |
 | SUSE-SU-2026:4937-1 Security update for the Linux Kernel | 15 дней назад | ||
| SUSE-SU-2026:4936-1 Security update for the Linux Kernel | 15 дней назад | ||
| SUSE-SU-2026:4934-1 Security update for the Linux Kernel | 15 дней назад | ||
| SUSE-SU-2026:4940-1 Security update for the Linux Kernel | 15 дней назад | ||
| SUSE-SU-2026:4935-1 Security update for the Linux Kernel | 15 дней назад | ||
| openSUSE-SU-2026:22167-1 Security update for the Linux Kernel | 20 дней назад |
Уязвимостей на страницу