Out-of-bounds read in the Linux kernel's IPv6 Neighbor Discovery Protocol stack via the rx_ndp_na handler allows a network-adjacent attacker to trigger a read beyond allocated memory by sending a crafted Neighbor Advertisement packet with a missing or malformed option length field. Affected systems are those running a vulnerable kernel version with IPv6 enabled. Impact is most likely a kernel crash (denial of service) or potential kernel memory disclosure, depending on memory layout at the time of exploitation. No public exploit and no KEV listing identified at time of analysis.
Out-of-bounds read in DHCP options parsing exposes systems running an Ubuntu-maintained networking component to potential memory disclosure or denial-of-service when processing malformed DHCP packets. The vulnerability arises from a size_t integer underflow in the rx_ip path when handling truncated DHCP options fields, allowing an attacker-controlled DHCP server on the local network segment to trigger reads beyond allocated buffer boundaries. No public exploit code has been identified at time of analysis, and exploitation probability data is unavailable due to the recency of this disclosure.
Out-of-bounds read in NetRx's audio message handling exposes memory contents and may cause service disruption when processing crafted MsgAudio payloads with unvalidated length fields. The affected component fails to validate the length field of incoming MsgAudio messages before using it to index or copy memory, a classic CWE-125-class flaw. Reported via Ubuntu's vendor channel; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free write in svxreflector, the reflector server component of the SvxLink amateur radio internet linking system, occurs when a dangling JSON reference is dereferenced after the underlying object has been freed. The vulnerability was disclosed via GitHub Security Advisory GHSA-6wgq-wg3w-jgvx and is tracked in Ubuntu's package ecosystem. Depending on attacker-controlled input over the network, exploitation could lead to memory corruption with potential for code execution or service disruption.
TCL command injection in a reflector client component, reported via Ubuntu's vendor security channel (GHSA-pc2g-2p95-4cr5), allows an attacker to inject arbitrary TCL commands through unsanitized input processed by the client. The specific impact scope - including whether this enables OS-level command execution or is confined to the TCL interpreter - cannot be confirmed from available data, as no CVSS vector, CWE, or patch advisory has been published. No public exploit or CISA KEV listing has been identified at the time of analysis.
Use-after-free via reentrant client deletion in svxreflector (SvxLink) allows a network-connected client to trigger memory corruption by initiating a disconnect sequence during an already-in-progress client deletion callback. The affected component is the SvxLink conference reflector server used in amateur radio linking systems. If exploitable beyond a crash, this could result in denial of service or arbitrary code execution within the reflector process.
Unbounded memory growth in the FRN module (GHSA-qccg-7pw6-787v) can lead to resource exhaustion in affected deployments. The vulnerability was reported via Ubuntu's vendor channel and is associated with a GitHub Security Advisory, suggesting it is a library or kernel module-level issue. No CVSS score, CWE classification, or version details have been published at time of analysis, making precise impact assessment limited.
TLS certificate expiry validation in an Ubuntu component uses a hardcoded date string '2025-01-01' instead of the current system time, causing certificate validity checks to produce incorrect results for any certificate whose notAfter field is evaluated against this static anchor. Affected systems may incorrectly accept expired certificates or reject valid ones depending on implementation logic. No CVSS score, CWE classification, KEV listing, or EPSS data is available at time of analysis.