Shigeru Yoshida

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.50 **Description** The issue is related to a buffer overflow in the `tipc udp addr2str()` function in the Linux kernel's TIPC (Transparent Inter Process Communication) protocol implementation. This can occur when an invalid UDP media address is provided, potentially leading to a buffer overflow access in `tipc media addr printf()`. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider modifying the `tipc udp addr2str()` function to return a non-zero value when an invalid UDP media address is encountered, thus preventing the buffer overflow access in `tipc media addr printf()`.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a potential uninit-value access in the ` ip6 make skb()` function. To avoid a race condition, the code now checks `FLOWI FLAG KNOWN NH` on `fl6->flowi6 flags` instead of testing `HDRINCL` on the socket. This change was made to fix a potential vulnerability, similar to a fix made for IPv4 in commit `fc1092f51567`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the crypto component of the Linux kernel, specifically with the algif hash function. When a zero-length message is hashed by algif hash and an error is triggered, it attempts to free an SG list that was never allocated. This can lead to a denial of service. The error occurs due to a bug in the zero-length error path, where the SG list is freed unnecessarily. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.