CVE-2026-101303None▾ SunlitThe IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services liste…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101309NoneThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101310NoneThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101311NoneThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
CVE-2026-101307NoneWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
CVE-2026-101308NoneWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer
CVE-2026-101305Nonerenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments