Executive brief
A vulnerability in the 9front operating system's networking stack allows a remote attacker to crash the system. By sending specially crafted network packets that are smaller than expected, an attacker can trigger a kernel panic, leading to a complete service outage. This affects systems using common protocols like TCP, UDP, and GRE.
Technical details
A denial-of-service vulnerability exists in the 9front operating system's IP stack (sys/src/9/ip/). The vulnerability is caused by insufficient validation of packet lengths relative to header sizes in the TCP, UDP, IL, RUDP, and GRE protocol implementations. When a packet is received with a length shorter than its mandatory header, the kernel attempts to call 'trimblock()' with a negative or underflowed size. This triggers an assertion failure within 'trimblock()', resulting in a kernel panic. An unauthenticated remote attacker can exploit this by sending malformed packets over the network. The issue has been addressed by adding length checks before calling 'trimblock()' and updating 'trimblock()' to handle negative offsets gracefully.
Affected products
- 9front 9front Prior to commit 70c97c334171c715df82774d1a47638abaca2db4
Timeline
- 2026-05-19: patched: Initial fixes committed to 9front repository
- 2026-05-22: disclosed: CVE-2026-9054 published