Jan Schaumann

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0 Linux kernel versions prior to 6.19.12 **Description** A flaw exists in the `algif aead` cryptographic algorithm interface of the Linux kernel. The issue stems from an incorrect in-place operation during cryptographic processing where source and destination data mappings differ. A local attacker with low privileges can exploit this by splicing a readable file into an `AF ALG` socket and requesting an AEAD operation. This allows the attacker to perform a deterministic 4-byte write directly into the kernel's page cache, which is the in-memory copy of any file the user can read. Because the page cache is shared between containers and the host, this can be used to corrupt sensitive system files (such as `/usr/bin/su` or `/usr/sbin/ipset`) in memory without altering the file on disk. This enables the attacker to bypass file integrity checks and escalate privileges to root. In Kubernetes environments, this can lead to a container escape where an unprivileged container achieves node-level code execution by corrupting a binary shared with a privileged DaemonSet like `kube-proxy`. **Recommendations** Update the Linux kernel to version 7.0 or 6.19.12 or newer. As a temporary mitigation, restrict the use of the `AF ALG` socket interface for untrusted users.

**Name of the Vulnerable Software and Affected Versions** NGINX OSS and NGINX Plus (affected versions not specified) F5 BIG-IP (affected versions not specified) **Description** A flaw exists in NGINX OSS and NGINX Plus when used to proxy to upstream Transport Layer Security (TLS) servers. An attacker positioned in a man-in-the-middle (MITM) configuration on the upstream server side, alongside specific conditions outside of the attacker’s control, may be able to inject plain text data into the response from a proxied upstream server. F5 has identified vulnerabilities in BIG-IP, NGINX, and container services that create denial-of-service risks, particularly in high-traffic environments like web application firewalls and Kubernetes ingress. These vulnerabilities could allow attackers to overwhelm services remotely, causing disruptions to service availability. One specific vulnerability, CVE-2026-1642, allows for network-adjacent denial-of-service attacks through crafted requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.