Jan Schaumann

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0 Linux kernel versions prior to 6.19.12 **Description** A flaw exists in the Linux kernel's `algif aead` cryptographic algorithm interface. The issue stems from an incorrect in-place operation during cryptographic processing where source and destination data mappings differ. A local attacker can exploit this by splicing a readable file into an `AF ALG` socket and requesting an AEAD operation. This triggers a race condition in the page-cache Copy-on-Write (CoW) path, allowing the attacker to write 4 bytes of controlled data directly into the kernel's page cache for any file they can read. Because the page cache is shared across containers and the host, this can be used to corrupt sensitive system binaries (e.g., `/usr/sbin/ipset` or `/usr/bin/su`) in memory without altering the file on disk. This allows an unprivileged user to execute arbitrary code with root privileges, potentially leading to a full container escape in Kubernetes environments by targeting privileged DaemonSets. **Recommendations** Update the Linux kernel to version 7.0 or later. Update the Linux kernel to version 6.19.12 or later.

**Name of the Vulnerable Software and Affected Versions** NGINX OSS and NGINX Plus (affected versions not specified) F5 BIG-IP (affected versions not specified) **Description** A flaw exists in NGINX OSS and NGINX Plus when used to proxy to upstream Transport Layer Security (TLS) servers. An attacker positioned in a man-in-the-middle (MITM) configuration on the upstream server side, alongside specific conditions outside of the attacker’s control, may be able to inject plain text data into the response from a proxied upstream server. F5 has identified vulnerabilities in BIG-IP, NGINX, and container services that create denial-of-service risks, particularly in high-traffic environments like web application firewalls and Kubernetes ingress. These vulnerabilities could allow attackers to overwhelm services remotely, causing disruptions to service availability. One specific vulnerability, CVE-2026-1642, allows for network-adjacent denial-of-service attacks through crafted requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.