IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2026-86848Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Fast Datapath for RHEL 10 Yayım: (28 gün önce)

Açıklama

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

Zayıflık türü (CWE): CWE-367

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
enterprise linux 10 —
enterprise linux 8 —
enterprise linux 9 —
Red Hat Fast Datapath for RHEL 10 all versions
Red Hat Fast Datapath for RHEL 8 all versions
Red Hat Fast Datapath for RHEL 9 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat OpenShift Container Platform 4 —
Red Hat Red Hat OpenStack Platform 13 (Queens) all versions

Kaynaklar ve yamalar

Aynı üründe son açıklar — Red Hat Enterprise Linux

7.8Yüksek
CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5Yüksek
CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…