by Kastro
Paper/Archive/CVE-2026-9054

CVE-2026-9054

9front 9front — Invalid IP packets cause a kernel panic

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
32
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 21.8.218 × 204.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.

Affected

ProductAffectedFixed inSource
9front863431cff8b47fa20625f4cbee3ea4e92367b152 – < 70c97c334171c715df82774d1a47638abaca2db470c97c334171c715df82774d1a47638abaca2db4CNA

Scores by source

9front (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:A/AU:Y/R:A
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgit.9front.org/plan9front/9front/7838d68969549f938cc8e80c0c2b4218cb12805c/commit.htmlrefgit.9front.org/plan9front/9front/f86917b75e9562f90545b7e484dbdcd748236952/commit.htmlrefgit.9front.org/plan9front/9front/70c97c334171c715df82774d1a47638abaca2db4/commit.html