CVE-2026-9054: 9front Kernel Panic from Malformed IP Packets
CVE-2026-9054 affects the 9front operating system and can be triggered by tcp, il, rudp or gre packets whose length is smaller than the header size, causing a kernel panic. The CVSS 4.0 score of 9.2 is provided by both listed providers, but the record shows no KEV listing and a low EPSS probability. The available commit references point to mitigation work, and administrators should check whether their systems include those changes.
Overview
CVE-2026-9054 is a denial-of-service condition in 9front. According to the record, IP packets using the tcp, il, rudp or gre protocols whose length is smaller than the header size can trigger a kernel panic. The record was published on 2026-05-22 and its source status is listed as Deferred.
Impact
- The described outcome is a kernel panic, which stops the operating system and interrupts services running on the host.
- The CVSS 4.0 vector in the record marks high impact on availability for the vulnerable system and for subsequent systems, with no confidentiality or integrity impact.
- The SSVC data in the record rates technical impact as partial and automatable as yes.
Affected products and versions
- Product listed: 9front 9front.
- The record gives the affected range as commit identifiers, starting at a commit that is greater than or equal to a given baseline and ending before a later commit. It does not give conventional version numbers.
- The record includes no fixed-version field. The fixes list is empty, but three commit pages tagged as mitigation are referenced, and the upper bound of the affected range matches one of them.
Exploitation status
- The record shows KEV listed as false, so no entry in the CISA KEV catalog is recorded.
- No confirmed exploitation appears in the sources consulted.
- The EPSS probability is 0.00507 with a percentile of 0.41577, and the SSVC exploitation field is none.
Remediation and mitigation
- Review the commit references listed in the record and confirm whether your 9front builds include the changes they describe.
- Prioritize systems that accept network traffic from untrusted segments, since the CVSS vector indicates network attack vector with no privileges or user interaction required.
- Where patching is not immediately possible, consider restricting inbound traffic for the listed protocols at network boundaries, after assessing operational impact.
- Validate remediation by confirming the running kernel build matches a version that includes the referenced changes.
Detection guidance
- Monitor for unexpected kernel panics, crash dumps or reboots on 9front hosts, and correlate them with network activity on the listed protocols.
- Review network telemetry for malformed or truncated IP packets reaching exposed hosts.
- Keep an inventory of 9front systems so that exposure can be assessed quickly.
Limitations of the available information
- The record does not state which 9front releases are affected in conventional version terms.
- The record does not confirm the exact relationship between the referenced commits and the fix, so this is an inference.
- The CWE name is not provided in the record, only the identifier.
- The record does not describe the vulnerable code path or any vendor advisory beyond the commit pages.
- Exploitation data is limited to the KEV, EPSS and SSVC fields in the record.
Frequently asked questions
What does CVE-2026-9054 allow?
According to the record, sending tcp, il, rudp or gre packets with a length smaller than the header size can trigger a kernel panic in 9front, which is a denial-of-service outcome.
Is CVE-2026-9054 known to be exploited?
The record shows no KEV listing and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none and the EPSS probability is low.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.