Several recently discovered dangerous vulnerabilities allow root access to a system or remote code execution.
- Details of four kernel vulnerabilities have been disclosed. Linux, allowing an unprivileged local user to execute code with root privileges. The issues were fixed in kernel updates. Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Exploits have been prepared for all vulnerabilities and have been demonstrated to work in Fedora 43/44 and Ubuntu 24.04. Exploitation of the first three vulnerabilities requires the ability to create user namespaces or the presence of CAP_NET_ADMIN rights, as well as enabling support for the subsystems in which the vulnerabilities are present (AH6/XFRM, TUN, PPPoE, and SCTP).
- DirtyAH6 (CVE-2026-80844, exploit) is a buffer overflow in the IPsec AH (Authentication Header) handler, caused by a lack of validation of header values. In addition to a local attack, this vulnerability could theoretically be exploited remotely under specific conditions.
- TUNderflow (CVE-2026-81000, exploit) - out-of-bounds write when parsing a malformed TUN packet.
- PPPoEject (CVE-2026-68121, exploit) - access to already freed memory in the PPPoE driver.
- DiagSpill (CVE-2026-74469, exploit) is a buffer overflow in SCTP protocol diagnostic tools. In addition to a local attack, the vulnerability could theoretically be exploited remotely under specific conditions.
- A vulnerability (CVE-2026-89775) in the KVM hypervisor allows access to the host environment from a guest system. If unprivileged users have access to the /dev/kvm device (by default in RHEL), the vulnerability can also be exploited to escalate their privileges. The issue only affects systems with the ARM64 architecture and nested virtualization support enabled. The vulnerability is caused by the size calculation routine returning "0," implying an unknown size, and the memory page deallocation function treating "0" as an actual value and failing to deallocate the memory pages.
- Exim 4.100.1 fixes four vulnerabilities: out-of-bounds read and use of uninitialized data in the Proxy protocol implementation; access after free in TLS-on-connect when using GnuTLS; and message substitution in a foreign stream (SMTP smuggling).
- Ghostscript 10.08.0 fixes a vulnerability (CVE-2026-39919) caused by a buffer overflow in JPEG 2000 parsing code when incorrect subsampling values are specified. This issue can lead to code execution when Ghostscript processes specially crafted PDF files with embedded JPEG 2000 images. The vulnerability is exacerbated by the fact that Ghostscript is invoked during desktop thumbnail generation, background data indexing, and image conversion. In many cases, simply uploading an exploited file or viewing its directory in Nautilus is sufficient for a successful attack. Ghostscript vulnerabilities can also be exploited through image handlers based on the ImageMagick and GraphicsMagick packages by passing them a JPEG or PNG file containing PostScript code instead of an image (such a file will be processed by Ghostscript, as the MIME type is determined by the content, rather than the extension). The issue is fixed in Ghostscript 10.08.0.
- Unbound DNS server 1.26.1 fixes nine vulnerabilities, including CVE-2026-81642, which causes a buffer overflow when processing certain DNSKEYs. This vulnerability can be exploited for remote code execution on the server. Also fixed are a buffer overflow in DNSSEC handling, memory corruption in the CNAME handler, and a use-after-free vulnerability in DoQ and DoH code.
- Suricata 8.0.7, a security system for intrusion detection and prevention, has fixed 67 vulnerabilities, two of which are marked as critical. Details of the issues have not yet been disclosed, but judging by their severity level, the vulnerabilities allow remote code execution when processing specially crafted traffic.
Source: opennet.ru
