Branch: refs/heads/stable1-proposed Home: https://github.com/kronosnet/kronosnet Commit: d83f360d07d5b3ae33bf9659a2502d3993f5bdcf https://github.com/kronosnet/kronosnet/commit/d83f360d07d5b3ae33bf9659a2502d... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)

Changed paths: M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c M libknet/threads_rx.c

Log Message: ----------- CVE-2026-15812: access control list bypass via link ID spoofing on unencrypted dynamic links

Severity: LOW

Exploitable only with unencrypted traffic (not supported for production).

Validate that packets originate from the configured source address for the claimed link_id. Previously, link_id was trusted without verification, allowing attackers to probe link states or confuse failover logic.

Implement secure-by-default model with proper static/dynamic link handling: - Enable use_access_lists=1 by default in knet_handle_new - Static links: always validate against auto-configured ACL - Dynamic links with use_access_lists=1 (default): require ACL or reject - Dynamic links with use_access_lists=0: skip validation (explicit opt-out)

Add bounds check, source address verification, and centralized _check_rx_acl(). Update tests to reflect secure-by-default model.

Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

Commit: bf8fd52acf47bb1fe2b1dce8d46ea54db07075c4 https://github.com/kronosnet/kronosnet/commit/bf8fd52acf47bb1fe2b1dce8d46ea5... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)

Changed paths: M libknet/tests/Makefile.am A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c

Log Message: ----------- CVE-2026-15813: memory corruption and out-of-bounds access via malformed network packet defragmentation

Severity: MEDIUM

Validate fragment sequence numbers before accessing defragmentation buffers. Previous code used unchecked sequence numbers as array indices, allowing heap buffer overflow.

Exploitable only with unencrypted traffic (not supported for production).

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

Compare: https://github.com/kronosnet/kronosnet/compare/ada3d6d62b90...bf8fd52acf47

To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications