https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 14:14:23 +0000 https://db.gcve.eu/vuln/cve-2026-99030 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: skbuff: don&#39;t leave stale bytes in skb_copy_and_csum_bits()</p> <p>When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller&#39;s buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver&#39;s TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.</p> <p>Zero the part of the buffer we didn&#39;t fill. The checksum usually won&#39;t match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn&#39;t. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: skbuff: don&#39;t leave stale bytes in skb_copy_and_csum_bits()</p> <p>When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller&#39;s buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver&#39;s TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.</p> <p>Zero the part of the buffer we didn&#39;t fill. The checksum usually won&#39;t match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn&#39;t. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().</p> https://db.gcve.eu/vuln/cve-2026-99030