Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-15813 EUVD-2026-45899GHSA-32vg-vj46-3h6w

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

Published Jul 20, 2026 · Updated Nov 5, 2026 · Assigned by redhat

Description

A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets with corrupted sequence parameters. Under specific conditions, this forces the packet processing layer to parse data outside the designated bounds of the internal memory structures, causing an out-of-bounds memory access or heap corruption. This behavior can result in sudden application crashes or system instability.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat OpenShift Container Platform 5 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 kronosnet 1.35-1 —
Debian 13 kronosnet No fix yet —
Debian 12 kronosnet No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 kronosnet No fix yet —
Ubuntu 26.04 LTS kronosnet No fix yet —
Ubuntu 24.04 LTS kronosnet No fix yet —
Ubuntu 22.04 LTS kronosnet No fix yet —
Ubuntu 20.04 LTS kronosnet No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS kronosnet No fix yet —
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kronosnet 1.30-160000.4.1 SUSE-SU-2026:23792-1
SLES 16.0 kronosnet 1.30-160000.4.1 SUSE-SU-2026:23782-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_15 3-160000.1.1 SUSE-SU-2026:23792-1
SLE Micro 6.2 rpm 4.20.1-160000.3.1 SUSE-SU-2026:23782-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kronosnet 1.33-2.1 openSUSE-SU-2026:11364-1
openSUSE Leap 16.0 kronosnet 1.30-160000.4.1 openSUSE-SU-2026:21851-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kronosnet No fix yet —

Advisories 4

References