Fedora Kronosnet Vulnerabilities Expose Low Memory and Access Control Risks

Fedora has identified multiple vulnerabilities in the Kronosnet VPN daemon affecting versions 1.35 and earlier. CVE-2026-15811 involves low-level encryption key exposure in memory, while CVE-2026-15812 allows access control list bypass via link ID spoofing. Additionally, CVE-2026-15813 addresses memory corruption from malformed network packets. These vulnerabilities could lead to unauthorized access and potential data exposure. The issues were reported on July 20 and 21, 2026, and have been documented in recent updates. Users are advised to audit Linux privileges and apply necessary patches. The vulnerabilities are categorized as low to medium severity, with no active exploitation reported at this time.

Key Points: • Multiple vulnerabilities in Fedora's Kronosnet VPN daemon were disclosed on July 21, 2026. • CVE-2026-15811 and CVE-2026-15812 pose risks related to encryption and access control. • Users are advised to audit privileges and apply patches to mitigate these vulnerabilities.