Loading story…
CERT Polska disclosed CVE-2026-15390, an out-of-bounds write in DENX Software Engineering's Das U-Boot bootloader affecting releases from 2009.08 through 2026.07. Builds configured with CONFIG_IP_DEFRAG=y fail to clear IP reassembly state after delivering a complete datagram, allowing an attacker who can send fragmented IP traffic to reuse duplicate final fragments and potentially achieve arbitrary code execution.
Mateusz Furdyna of Nokia responsibly reported the flaw, with CERT Polska coordinating disclosure. The vulnerability was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa, included in Das U-Boot release 2026.07; organizations using affected network-enabled bootloader builds should verify the incorporated fix and update where necessary.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CISA recorded an SSVC assessment for CVE-2026-15390, stating that exploitation was "none," automatable exploitation was "no," and technical impact was "total."
CERT Polska published CVE-2026-15390 for the Das U-Boot out-of-bounds write vulnerability. The issue was responsibly reported by Mateusz Furdyna of Nokia and disclosure was coordinated by CERT Polska.
Das U-Boot release 2026.07 included commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa, which fixes the IP reassembly out-of-bounds write vulnerability.
An out-of-bounds write flaw in Das U-Boot when built with CONFIG_IP_DEFRAG=y leaves IP reassembly state uncleared after a complete datagram. An attacker able to deliver fragmented IP traffic can send duplicate final fragments to potentially achieve arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecert.pl
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026
A flaw in the Linux kernel's BPF disassembler was reported after **syzbot** and **UBSAN** identified an out-of-bounds array access in `print_bpf_insn()`, the function used to format BPF instructions for verifier diagnostics. The bug is triggered when a malformed signed-load instruction using `BPF_MEMSX | BPF_DW` reaches diagnostic disassembly code before opcode validation fully rejects it, causing the kernel to index past the end of the three-entry `bpf_ldsx_string[]` table. No evidence has been presented that the issue enables privilege escalation, information disclosure, remote exploitation, or abuse by unprivileged users. A two-patch fix was proposed and then applied to `bpf/bpf.git`, changing the disassembler to reject invalid signed double-word load encodings and fall back to the existing `BUG_ldx` diagnostic path instead of performing the unsafe table lookup. The patch series, authored by Kumar Kartikeya Dwivedi, reviewed by Jiayuan Chen, and merged by Daniel Borkmann, also adds a self-test to catch regressions. The issue appears to exist in current kernel source, but affected released versions and downstream distributions have not yet been identified.
Aug 21, 2026