24h | 7d | 30d

CVE-2026-43284

Overview

  • Linux
  • Linux
08 May 2026
Published
09 May 2026
Updated
CVSS
Pending
EPSS
0.01%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

Statistics

  • 23 Posts
  • 268 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Jan Schaumann @jschauma

#DirtyFrag status/advisories:

AlmaLinux:
almalinux.org/blog/2026-05-07-

Debian:
security-tracker.debian.org/tr
security-tracker.debian.org/tr

Gentoo:
bugs.gentoo.org/974307

RedHat:
bugzilla.redhat.com/show_bug.c
access.redhat.com/security/cve
nothing yet on CVE-2026-43500

Rocky:
kb.ciq.com/article/rocky-linux

SUSE / OpenSUSE:
suse.com/security/cve/CVE-2026
suse.com/security/cve/CVE-2026
suse.com/c/addressing-copy-fai

Ubuntu:
ubuntu.com/security/CVE-2026-4
ubuntu.com/security/CVE-2026-4
ubuntu.com/blog/dirty-frag-lin

AWS:
aws.amazon.com/security/securi
explore.alas.aws.amazon.com/CV

  • 63
  • 55
  • 0
  • 15h ago
Profile picture fallback
Alpine Linux :alpine: @alpinelinux

2 new vulnerabilities similar to copyfail:

- CVE-2026-43284 (Dirty Frag)
- CVE-2026-43500

github.com/V4bel/dirtyfrag

We're waiting for a release containing the last one before pushing new kernels to aports.

github.com/V4bel/dirtyfrag#mit mentions a mitigation in the meantime.

  • 36
  • 26
  • 0
  • 22h ago
Profile picture fallback
Veronica Olsen @veronica

Just got a kernel update from Debian 13's security channel, which fixes both CVE-2026-43284 and CVE-2026-43500, aka "Dirty Frag".

Debian 12 is not yet patched.

Tracker Links:
security-tracker.debian.org/tr
security-tracker.debian.org/tr

#DirtyFrag #Debian #Linux #Kernel #InfoSec

  • 17
  • 23
  • 0
  • 16h ago
Profile picture fallback
Larvitz :fedora: @Larvitz

CVE-2026-43284 / "Dirty Frag" .. Antoher one of those nasty local-privilege-escallations.

Quickfix for Centos/Fedora based systems:

printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf && rmmod esp4 esp6 rxrpc 2>/dev/null; true

Caution: That also effectively disables IPSEC and AFS client support. But it can easily be reverted by removing the file when a patched kernel arrives.

#dirtyfrag #cve_2026_43284 #security #centos #fedora #redhat

  • 4
  • 5
  • 0
  • 13h ago
Profile picture fallback
:mastodon: decio @decio

Nouveaux kernels stables : 7.0.5 / 6.18.28 / 6.12.87 / 6.6.138

Ils embarquent un fix partiel pour (CVE-2026-43284) et Copy Fail 2.

Partiel, car Greg Kroah-Hartman a confirmé qu'un second patch est encore en développement et n'a pas encore été mergé.

La mitigation par blacklist des modules reste donc recommandée en attendant.
👇
lwn.net/Articles/1071775/

  • 0
  • 1
  • 0
  • 23h ago
Profile picture fallback
Doug Burks @dougburks

OhMyDebn 3.7.1 now available with mitigation for Dirty Frag local privilege escalation (CVE-2026-43284)

OhMyDebn is a debonair Linux desktop for power users. It gives you the stability of the Debian distro, the ease of use of the Cinnamon desktop, and the power of AI, containers, and virtualization.

  • 0
  • 1
  • 0
  • 21h ago
Profile picture fallback
:mastodon: decio @decio

[related]
chez AlmaLinux

"Dirty Frag (CVE-2026-43284) vulnerability fix is ready for testing"
👇
almalinux.org/blog/2026-05-07-

  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
CyberNetsecIO @netsecio

📰 Critical Unpatched 'Dirty Frag' Linux Zero-Day Allows Instant Root Access

🚨 CRITICAL ZERO-DAY: 'Dirty Frag' (CVE-2026-43284) vulnerability in Linux kernel disclosed with NO PATCH. Allows immediate root privilege escalation. Flaw has existed for 9 years. Admins must seek mitigations now! 🐧🔥 #Linux #ZeroDay #CyberSecurity

🔗 cyber.netsecops.io

  • 0
  • 0
  • 0
  • 15h ago
Profile picture fallback
Stéphane Bortzmeyer @bortzmeyer

@jschauma About istheinternetonfire.com/ DirtyFrag now has one CVE (two, actually) CVE-2026-43284 and CVE-2026-43500

  • 2
  • 2
  • 0
  • 20h ago
Profile picture fallback
dragosr @dragosr

"Dirty Frag" status update on the clickbait overhype: ESP half (CVE-2026-43284) now patched: mainline f4c50a4034e6, stable backports in 7.0.5 / 6.18.28 / 6.12.87 / 6.6.138 / 6.1.171 / 5.15.205 / 5.10.255. RxRPC half (CVE-2026-43500) still unpatched upstream. AWS now adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc, adjacent xfrm code paths, defense in depth or a hint more is coming. AlmaLinux and CloudLinux shipped both fixes. Ubuntu, Debian, RHEL, Amazon still mitigation only.

  • 2
  • 2
  • 0
  • 11h ago
Profile picture fallback
Daniel Gibson @Doomed_Daniel

As I haven't seen this in my timeline yet:
There is another #Linux #zeroday privilege escalation #vulnerability.
No, not copy_fail, a new one, called DirtyFrag, combining CVE-2026-43284 and CVE-2026-43500

Apparently the finder was gonna disclose this responsibly, but they claim the embargo was broken by a third party.

Most probably not patched yet in distros, but fix (at least for one of the CVEs) is in mainline.

github.com/V4bel/dirtyfrag

A workaround/mitigation exists: github.com/V4bel/dirtyfrag#mit

  • 1
  • 3
  • 0
  • 18h ago
Profile picture fallback
Adhidarma Hadiwinoto :verifyc: @adhisimon

Habis #CopyFail terbitlah #DirtyFrag

  • CVE-2026-43284
  • CVE-2026-43500

Belum coba sih poc-nya, tapi sepertinya simpel juga.

github.com/V4bel/dirtyfrag/blo

#linux #cve #infosec

  • 1
  • 1
  • 0
  • 4h ago
Profile picture fallback
:mastodon: decio @decio

Les deux vulnérabilités composant ont reçu leurs numéros CVE :

🔴 CVE-2026-43284 — xfrm-ESP Page-Cache Write (patché en mainline : f4c50a4034e6)
🟡 CVE-2026-43500 — RxRPC Page-Cache Write

Si ce n'est pas encore fait, la mitigation reste de blacklister esp4, esp6 et rxrpc.
👇
vulnerability.circl.lu/vuln/CV

  • 1
  • 0
  • 0
  • 23h ago
Profile picture fallback
Naty @eclecticpassions

Another day, another severe Linux vulnerability / bug: #DirtyFrag

Links:

theregister.com/security/2026/

bleepingcomputer.com/news/secu

Mitigation:

github.com/V4bel/dirtyfrag#mit

CVE:
nvd.nist.gov/vuln/detail/CVE-2

#cve_2026_43500 #cve_2026_43284 #cve #Linux #ZeroDay #infosec #security

  • 0
  • 3
  • 0
  • 6h ago
Profile picture fallback
aqz/tamaina @aqz
[ Linux KernelのLPE(Local Privilege Escalation)脆弱性(Dirty Frag: CVE-2026-43284, CVE-2026-43500) - SIOS SECURITY BLOG ]
https://security.sios.jp/vulnerability/kernel-security-vulnerability-20260508/
  • 0
  • 0
  • 0
  • 21h ago
Profile picture fallback
B̷̻̠͊͛̀̽e̷͈̪̮̙͋͌̈́n̵̢̲̥̳̔ :rebel: :donor: :verified_paw: :verified_paw: @aircooledcafe

@Edent In theory yes, if they load one of the vulnerable kernel modules then you could achieve root on them with a compatible exploit.
The vulnerable module in the initial CopyFail exploit was AF_ALG.

There is a good summary of the vulnerable modules for the second two disclosed this week here, there are more, in this post on @ifin
discourse.ifin.network/t/cve-2

  • 0
  • 0
  • 0
  • 1h ago
Profile picture fallback
Nicolás Alvarez @nicolas17

Did you update your Linux kernel again to protect against the last privilege escalation bug?

No, not CopyFail (CVE-2026-31431), the new DirtyFrag (CVE-2026-43284, CVE-2026-43500).

  • 1
  • 5
  • 0
  • 14h ago

Bluesky

Profile picture fallback
Microsoft Threat Intelligence @threatintel.microsoft.com
A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking & memory-fragment handling components, including esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500). msft.it/6015v3WNc
  • 5
  • 6
  • 0
  • 16h ago
Profile picture fallback
Eyal Estrin ☁️ @eyalestrin.bsky.social
"Dirty Frag" Linux Kernel LPE Zero-Day (CVE-2026-43284, CVE-2026-43500) #patchmanagement
  • 1
  • 0
  • 0
  • 15h ago
Profile picture fallback
dragosr @dragostech.bsky.social
"Dirty Frag" clickbait update: ESP (CVE-2026-43284) patched in mainline + stable (7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.171). RxRPC (CVE-2026-43500) still unpatched upstream. AWS adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc. AlmaLinux shipped both. Ubuntu/Debian mitigation only.
  • 0
  • 1
  • 0
  • 11h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 Dirty Frag : deux vulnérabilités Linux permettent l'élévation de privilèges root (CVE-2026-43284 / CVE-2026-43500) 📝 #… https://cyberveille.ch/posts/2026-05-08-dirty-frag-deux-vulnerabilites-linux-permettent-l-elevation-de-privileges-root-cve-2026-43284-cve-2026-43500/ #CVE_2026_43284 #Cyberveille
  • 0
  • 0
  • 0
  • 18h ago
Profile picture fallback
piggo @pigondrugs.bsky.social
~Cybergcca~ Alert on unpatched Linux LPE flaws (Dirty Frag) with active PoCs, plus Edge & cPanel updates. - IOCs: CVE-2026-43284, CVE-2026-43500 - #Linux #ThreatIntel #Vulnerability
  • 0
  • 0
  • 0
  • 13h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
DirtyFrag exploits two Linux kernel bugs, CVE-2026-43284 and CVE-2026-43500, enabling local root access on major distros including Ubuntu, RHEL, Fedora, CentOS Stream, AlmaLinux, and openSUSE. #LinuxRoot #KernelExploit #USA
  • 0
  • 0
  • 0
  • 12h ago

CVE-2026-43500

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 19 Posts
  • 268 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Jan Schaumann @jschauma

#DirtyFrag status/advisories:

AlmaLinux:
almalinux.org/blog/2026-05-07-

Debian:
security-tracker.debian.org/tr
security-tracker.debian.org/tr

Gentoo:
bugs.gentoo.org/974307

RedHat:
bugzilla.redhat.com/show_bug.c
access.redhat.com/security/cve
nothing yet on CVE-2026-43500

Rocky:
kb.ciq.com/article/rocky-linux

SUSE / OpenSUSE:
suse.com/security/cve/CVE-2026
suse.com/security/cve/CVE-2026
suse.com/c/addressing-copy-fai

Ubuntu:
ubuntu.com/security/CVE-2026-4
ubuntu.com/security/CVE-2026-4
ubuntu.com/blog/dirty-frag-lin

AWS:
aws.amazon.com/security/securi
explore.alas.aws.amazon.com/CV

  • 63
  • 55
  • 0
  • 15h ago
Profile picture fallback
Alpine Linux :alpine: @alpinelinux

2 new vulnerabilities similar to copyfail:

- CVE-2026-43284 (Dirty Frag)
- CVE-2026-43500

github.com/V4bel/dirtyfrag

We're waiting for a release containing the last one before pushing new kernels to aports.

github.com/V4bel/dirtyfrag#mit mentions a mitigation in the meantime.

  • 36
  • 26
  • 0
  • 22h ago
Profile picture fallback
mc.fly @mcfly

and we have another one. This one with CVE.

#dirtyfrag #CVE-2026-43500

  • 7
  • 4
  • 0
  • 19h ago
Profile picture fallback
Veronica Olsen @veronica

Just got a kernel update from Debian 13's security channel, which fixes both CVE-2026-43284 and CVE-2026-43500, aka "Dirty Frag".

Debian 12 is not yet patched.

Tracker Links:
security-tracker.debian.org/tr
security-tracker.debian.org/tr

#DirtyFrag #Debian #Linux #Kernel #InfoSec

  • 17
  • 23
  • 0
  • 16h ago
Profile picture fallback
Marcel @wrmsr

Why wait for the slow UEFI when you can just `systemctl kexec` to remediate Dirty Frag with (almost) sub- 1 Minute downtime (2nd reboot for CVE-2026-43500 follows)
(all VMs except the pinned ones have been migrated off before)

  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
Stéphane Bortzmeyer @bortzmeyer

@jschauma About istheinternetonfire.com/ DirtyFrag now has one CVE (two, actually) CVE-2026-43284 and CVE-2026-43500

  • 2
  • 2
  • 0
  • 20h ago
Profile picture fallback
dragosr @dragosr

"Dirty Frag" status update on the clickbait overhype: ESP half (CVE-2026-43284) now patched: mainline f4c50a4034e6, stable backports in 7.0.5 / 6.18.28 / 6.12.87 / 6.6.138 / 6.1.171 / 5.15.205 / 5.10.255. RxRPC half (CVE-2026-43500) still unpatched upstream. AWS now adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc, adjacent xfrm code paths, defense in depth or a hint more is coming. AlmaLinux and CloudLinux shipped both fixes. Ubuntu, Debian, RHEL, Amazon still mitigation only.

  • 2
  • 2
  • 0
  • 11h ago
Profile picture fallback
Daniel Gibson @Doomed_Daniel

As I haven't seen this in my timeline yet:
There is another #Linux #zeroday privilege escalation #vulnerability.
No, not copy_fail, a new one, called DirtyFrag, combining CVE-2026-43284 and CVE-2026-43500

Apparently the finder was gonna disclose this responsibly, but they claim the embargo was broken by a third party.

Most probably not patched yet in distros, but fix (at least for one of the CVEs) is in mainline.

github.com/V4bel/dirtyfrag

A workaround/mitigation exists: github.com/V4bel/dirtyfrag#mit

  • 1
  • 3
  • 0
  • 18h ago
Profile picture fallback
Adhidarma Hadiwinoto :verifyc: @adhisimon

Habis #CopyFail terbitlah #DirtyFrag

  • CVE-2026-43284
  • CVE-2026-43500

Belum coba sih poc-nya, tapi sepertinya simpel juga.

github.com/V4bel/dirtyfrag/blo

#linux #cve #infosec

  • 1
  • 1
  • 0
  • 4h ago
Profile picture fallback
:mastodon: decio @decio

Les deux vulnérabilités composant ont reçu leurs numéros CVE :

🔴 CVE-2026-43284 — xfrm-ESP Page-Cache Write (patché en mainline : f4c50a4034e6)
🟡 CVE-2026-43500 — RxRPC Page-Cache Write

Si ce n'est pas encore fait, la mitigation reste de blacklister esp4, esp6 et rxrpc.
👇
vulnerability.circl.lu/vuln/CV

  • 1
  • 0
  • 0
  • 23h ago
Profile picture fallback
Naty @eclecticpassions

Another day, another severe Linux vulnerability / bug: #DirtyFrag

Links:

theregister.com/security/2026/

bleepingcomputer.com/news/secu

Mitigation:

github.com/V4bel/dirtyfrag#mit

CVE:
nvd.nist.gov/vuln/detail/CVE-2

#cve_2026_43500 #cve_2026_43284 #cve #Linux #ZeroDay #infosec #security

  • 0
  • 3
  • 0
  • 6h ago
Profile picture fallback
aqz/tamaina @aqz
[ Linux KernelのLPE(Local Privilege Escalation)脆弱性(Dirty Frag: CVE-2026-43284, CVE-2026-43500) - SIOS SECURITY BLOG ]
https://security.sios.jp/vulnerability/kernel-security-vulnerability-20260508/
  • 0
  • 0
  • 0
  • 21h ago
Profile picture fallback
Nicolás Alvarez @nicolas17

Did you update your Linux kernel again to protect against the last privilege escalation bug?

No, not CopyFail (CVE-2026-31431), the new DirtyFrag (CVE-2026-43284, CVE-2026-43500).

  • 1
  • 5
  • 0
  • 14h ago

Bluesky

Profile picture fallback
Microsoft Threat Intelligence @threatintel.microsoft.com
A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking & memory-fragment handling components, including esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500). msft.it/6015v3WNc
  • 5
  • 6
  • 0
  • 16h ago
Profile picture fallback
Eyal Estrin ☁️ @eyalestrin.bsky.social
"Dirty Frag" Linux Kernel LPE Zero-Day (CVE-2026-43284, CVE-2026-43500) #patchmanagement
  • 1
  • 0
  • 0
  • 15h ago
Profile picture fallback
dragosr @dragostech.bsky.social
"Dirty Frag" clickbait update: ESP (CVE-2026-43284) patched in mainline + stable (7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.171). RxRPC (CVE-2026-43500) still unpatched upstream. AWS adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc. AlmaLinux shipped both. Ubuntu/Debian mitigation only.
  • 0
  • 1
  • 0
  • 11h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 Dirty Frag : deux vulnérabilités Linux permettent l'élévation de privilèges root (CVE-2026-43284 / CVE-2026-43500) 📝 #… https://cyberveille.ch/posts/2026-05-08-dirty-frag-deux-vulnerabilites-linux-permettent-l-elevation-de-privileges-root-cve-2026-43284-cve-2026-43500/ #CVE_2026_43284 #Cyberveille
  • 0
  • 0
  • 0
  • 18h ago
Profile picture fallback
piggo @pigondrugs.bsky.social
~Cybergcca~ Alert on unpatched Linux LPE flaws (Dirty Frag) with active PoCs, plus Edge & cPanel updates. - IOCs: CVE-2026-43284, CVE-2026-43500 - #Linux #ThreatIntel #Vulnerability
  • 0
  • 0
  • 0
  • 13h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
DirtyFrag exploits two Linux kernel bugs, CVE-2026-43284 and CVE-2026-43500, enabling local root access on major distros including Ubuntu, RHEL, Fedora, CentOS Stream, AlmaLinux, and openSUSE. #LinuxRoot #KernelExploit #USA
  • 0
  • 0
  • 0
  • 12h ago

CVE-2026-6973

Overview

  • Ivanti
  • Endpoint Manager Mobile
07 May 2026
Published
08 May 2026
Updated
CVSS v3.1
HIGH (7.2)
EPSS
5.01%
KEV

Description

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

Statistics

  • 6 Posts
  • 1 Interaction
Last activity: 18 hours ago

Fediverse

Profile picture fallback
Vito Botta @vitobotta

CISA KEV update May 7: CVE-2026-6973 Ivanti EPMM added. Actively exploited input validation flaw. Federal deadline applies, everyone else should patch. - cisa.gov/news-events/alerts/20

  • 0
  • 0
  • 0
  • 21h ago
Profile picture fallback
Jeff Hall - PCIGuru :verified: @jbhall56

Tracked as CVE-2026-6973, this security flaw allows attackers with administrative privileges to execute arbitrary code remotely on systems running EPMM 12.8.0.0 and earlier. bleepingcomputer.com/news/secu

  • 0
  • 0
  • 1
  • 20h ago

Bluesky

Profile picture fallback
Rene Robichaud @neroqc.bsky.social
Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) www.helpnetsecurity.com/2026/05/08/i...
  • 0
  • 1
  • 0
  • 20h ago
Profile picture fallback
Help Net Security @helpnetsecurity.com
Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973) 📖 Read more: www.helpnetsecurity.com/2026/05/08/i... #cybersecurity #cybersecuritynews #0day #endpointmanagement #vulnerability
  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
Ivanti: We are aware of a very limited number of customers exploited with CVE-2026-6973. Successful exploitation requires Admin authentication.
  • 0
  • 0
  • 0
  • 18h ago

CVE-2026-31431

Overview

  • Linux
  • Linux
22 Apr 2026
Published
08 May 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
3.91%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Statistics

  • 5 Posts
  • 37 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
AlmaLinux @almalinux

⚠️ PSA: patch your AlmaLinux systems.

Copy Fail lets any local user escalate to root. We shipped fixes for AL 8, 9 & 10 ahead of upstream—they're in production now. almalinux.org/blog/2026-05-01-

  • 13
  • 12
  • 1
  • 17h ago
Profile picture fallback
Golem.de @Golemde

Was Sysadmins zu CVE 2026 31431 wissen müssen
golem.de/news/732-bytes-bis-ro

Gepostet in GOLEM @golem-Golemde

  • 1
  • 0
  • 0
  • 1h ago
Profile picture fallback
Nicolás Alvarez @nicolas17

Did you update your Linux kernel again to protect against the last privilege escalation bug?

No, not CopyFail (CVE-2026-31431), the new DirtyFrag (CVE-2026-43284, CVE-2026-43500).

  • 1
  • 5
  • 0
  • 14h ago

Bluesky

Profile picture fallback
Microsoft Threat Intelligence @threatintel.microsoft.com
Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.
  • 0
  • 5
  • 0
  • 16h ago

CVE-2026-0300

Overview

  • Palo Alto Networks
  • Cloud NGFW
06 May 2026
Published
07 May 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
4.65%
KEV

Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Statistics

  • 4 Posts
Last activity: 15 hours ago

Fediverse

Profile picture fallback
Jeff Hall - PCIGuru :verified: @jbhall56

The vulnerability in question is CVE-2026-0300 (CVSS score: 9.3/8.7), a buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software that could allow an unauthenticated attacker to execute arbitrary code with root privileges by sending specially crafted packets. thehackernews.com/2026/05/pan-

  • 0
  • 0
  • 1
  • 21h ago
Profile picture fallback
CyberNetsecIO @netsecio

📰 Critical Palo Alto Networks Zero-Day (CVE-2026-0300) Actively Exploited for RCE

🚨 CRITICAL ZERO-DAY: Palo Alto Networks warns of an unpatched, actively exploited RCE vulnerability (CVE-2026-0300) in PAN-OS firewalls. The flaw allows root access via the User-ID portal. Mitigate immediately! #CyberSecurity #ZeroDay #PANOS

🔗 cyber.netsecops.io

  • 0
  • 0
  • 0
  • 15h ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 Exploitation active de CVE-2026-0300 : RCE critique dans PAN-OS par un acteur étatique 📝 ## 🗓️ Contexte Publié le 8 mai 2026 par Truesec, cet art… https://cyberveille.ch/posts/2026-05-08-exploitation-active-de-cve-2026-0300-rce-critique-dans-pan-os-par-un-acteur-etatique/ #CL_STA_1132 #Cyberveille
  • 0
  • 0
  • 0
  • 19h ago

CVE-2025-70994

Overview

  • Pending
23 Apr 2026
Published
23 Apr 2026
Updated
CVSS
Pending
EPSS
0.03%
KEV

Description

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmission, allowing for complete unauthorized vehicle operation via a replay attack.

Statistics

  • 2 Posts
Last activity: 17 hours ago

Fediverse

Profile picture fallback
:mastodon: decio @decio

Sur le même sujet: moto-station.com/moto-revue/ac

Recherche citée pour les scooters Yadea: github.com/ktauchathuranga/CVE

💬
⬇️
infosec.pub/post/46128998

  • 0
  • 0
  • 0
  • 21h ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 CVE-2025-70994 : Vulnérabilité de replay attack sur le vélo électrique Yadea T5 via protocole EV1527 📝 ## 🔍 Contexte Publié le 8 mai 2026… https://cyberveille.ch/posts/2026-05-08-cve-2025-70994-vulnerabilite-de-replay-attack-sur-le-velo-electrique-yadea-t5-via-protocole-ev1527/ #CISA #Cyberveille
  • 0
  • 0
  • 0
  • 17h ago

CVE-2025-68670

Overview

  • neutrinolabs
  • xrdp
27 Jan 2026
Published
03 Feb 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.12%
KEV

Description

xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

Statistics

  • 2 Posts
Last activity: Last hour

Bluesky

Profile picture fallback
piggo @pigondrugs.bsky.social
~Kaspersky~ A pre-auth RCE flaw (CVE-2025-68670) in xrdp allows arbitrary code execution via a buffer overflow during domain name parsing. - IOCs: CVE-2025-68670 - #CVE202568670 #ThreatIntel #xrdp
  • 0
  • 0
  • 0
  • 21h ago
Profile picture fallback
Eyal Estrin ☁️ @eyalestrin.bsky.social
CVE-2025-68670: discovering an RCE vulnerability in xrdp #appsec
  • 0
  • 0
  • 0
  • Last hour

CVE-2026-42826

Overview

  • Microsoft
  • Azure DevOps
07 May 2026
Published
09 May 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.09%
KEV

Description

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

Statistics

  • 1 Post
  • 23 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
nyanbinary @nyanbinary

Oh, neat, the daily MS CVSS 10 :apartyblobcat:

nvd.nist.gov/vuln/detail/cve-2

  • 8
  • 15
  • 0
  • 17h ago

CVE-2026-7896

Overview

  • Google
  • Chrome
06 May 2026
Published
07 May 2026
Updated
CVSS
Pending
EPSS
0.06%
KEV

Description

Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 19 hours ago

Fediverse

Profile picture fallback
:awesome:🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉 @nemo

Google pushes massive Chrome 148 security update — patches 127 flaws including 3 critical bugs (CVE-2026-7896/7897/7898). Users are urged to update now; fixes also affect Chromium-based browsers (e.g., Brave, Helix). Read more: cyberinsider.com/google-pushes 🔒⚠️ #Chrome #Security #Cybersecurity

  • 2
  • 1
  • 0
  • 19h ago

CVE-2026-31717

Overview

  • Linux
  • Linux
01 May 2026
Published
03 May 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.04%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID. According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
SNeela @vmcall

Davide Ornaghi and Giuseppe Caruso found a very interesting bug in 's in-kernel Samba3 server from 6.12 to 6.19.x. Essentially, from the commit message and description:

> Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID.

Very interesting stuff! The kernel let's users resume their connection to an open file even after WiFi drops (durable handle), and a bug in this code let another authenticated user become this WiFi-dropped user, letting the hijacker access all files.

github.com/TurtleARM/CVE-2026-

CVE-2026-31717

  • 1
  • 2
  • 0
  • 5h ago
Showing 1 to 10 of 66 CVEs