CVE-2026-9054
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.
CVSS
—
No CVSS
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Published: May 22, 2026 · Last modified: Jul 23, 2026 · CWE-130
0.3%EPSS · 30 days0.3%
2026-08-102026-09-06
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.
- git.9front.orghttps://git.9front.org/plan9front/9front/70c97c334171c715df82774d1a47638abaca2db4/commit.html
- git.9front.orghttps://git.9front.org/plan9front/9front/7838d68969549f938cc8e80c0c2b4218cb12805c/commit.html
- git.9front.orghttps://git.9front.org/plan9front/9front/f86917b75e9562f90545b7e484dbdcd748236952/commit.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-5706—18.6%
——6In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may be impacted.10dCVE-2026-714025.4 MED6.4%
——2An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.6dCVE-2026-815757.5 HIG37.0%
——11If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a
segmentation fault that ultimately crashes the CodeMeter Runtime.6dCVE-2026-580977.8 HIG12.2%
——4mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.
A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.12dCVE-2026-580968.8 HIG44.1%
——13LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write.
A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.12dCVE-2026-145877.5 HIG30.3%
——9Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.
This can be triggered before authentication by any client that can reach the Bolt connector.11d