CVE-2026-6554
published 2026-09-05CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.10%
1.0th percentile
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_tcpdump_group | libpcap | < 1.10.7 | 1.10.7 |
| the_tcpdump_group | libpcap | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Tcpdump Group libpcap up to 1.10.6 BPF Interpreter infinite loop (EUVD-2026-72019)
vuldb·2026-09-05·CVSS 5.5
CVE-2026-6554 [MEDIUM] Tcpdump Group libpcap up to 1.10.6 BPF Interpreter infinite loop (EUVD-2026-72019)
A vulnerability, which was classified as problematic, has been found in Tcpdump Group libpcap up to 1.10.6. The impacted element is an unknown function of the component BPF Interpreter. Performing a manipulation results in infinite loop.
This vulnerability is identified as CVE-2026-6554. The attack is only possible with local access. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations.
ghsa_unreviewed·2026-09-05
CVE-2026-6554 [MEDIUM] CWE-835 libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations.
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
Red Hat
libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
vendor_redhat·2026-09-05·CVSS 5.5
CVE-2026-6554 [MEDIUM] CWE-835 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial of Service (DoS) condition.
Statement: This Moderate impact flaw in libpcap's BPF interpreter could lead to a denial of service. Explo
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-98184 kernel: wifi: mwifiex: prevent authentication frame length truncation
bugzilla·2026-10-06
CVE-2026-98184 [MEDIUM] CVE-2026-98184 kernel: wifi: mwifiex: prevent authentication frame length truncation
CVE-2026-98184 kernel: wifi: mwifiex: prevent authentication frame length truncation
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: prevent authentication frame length truncation
mwifiex_cfg80211_authenticate() derives the authentication frame length
from req->ie_len and req->auth_data_len, both of type size_t, but stores
it in a u16.
NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is
a u16, a single attribute can carry up to 65531 bytes of payload, so the
sum can exceed U16_MAX before it is assigned to pkt_len. The truncated
pkt_len determines the skb frame area, while the copy length remains
req->auth_data_len - 4, resulting in a heap buffer overflow.
For example, with auth_data_len equal to 65510 and no IEs, the sum is
6554
Bugzilla
CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter [fedora-all]
bugzilla·2026-09-09·CVSS 5.5
CVE-2026-6554 [MEDIUM] CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter [fedora-all]
CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
Bugzilla
CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
bugzilla·2026-09-05·CVSS 5.5
CVE-2026-6554 [MEDIUM] CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
CVE-2026-6554 libpcap: libpcap: Denial of Service via infinite loop in BPF interpreter
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
Bugzilla
CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
bugzilla·2026-05-21
CVE-2026-43501 [HIGH] CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom. Once skb_push() leaves
fewer than skb->mac_len bytes in
Bugzilla
CVE-2026-43321 kernel: bpf: Properly mark live registers for indirect jumps
bugzilla·2026-05-08
CVE-2026-43321 [MEDIUM] CVE-2026-43321 kernel: bpf: Properly mark live registers for indirect jumps
CVE-2026-43321 kernel: bpf: Properly mark live registers for indirect jumps
In the Linux kernel, the following vulnerability has been resolved:
bpf: Properly mark live registers for indirect jumps
For a `gotox rX` instruction the rX register should be marked as used
in the compute_insn_live_regs() function. Fix this.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050819-CVE-2026-43321-6554@gregkh/T
2026-09-05
Published