CVE-2026-101302None▾ SunlitTLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invali…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.
A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101309NoneThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101310NoneThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101311NoneThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
CVE-2026-101307NoneWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
CVE-2026-101308NoneWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer
CVE-2026-101305Nonerenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments