CVE-2026-101307None▾ SunlitWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples in…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.
A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101310NoneThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-58098NoneWhen semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps
CVE-2026-58095High· 8.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially e…
CVE-2026-58096High· 8.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717
CVE-2026-58097High· 7.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially e…
CVE-2026-101309NoneThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest