ipv4: If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header.

Affected versions:
All versions above 2.6.27 unless they got a patch applied to them, many branches already got the patch backported to them:
• 5.10: through 5.10.271 → fixed in 5.10.272
• 5.15: through 5.15.222 → fixed in 5.15.223
• 6.1: through 6.1.189 → fixed in 6.1.190
• 6.6: through 6.6.158 → fixed in 6.6.159
• 6.12: through 6.12.112 → fixed in 6.12.113
• 6.18: through 6.18.56 → fixed in 6.18.57
• 7.2: through 7.2.10 → fixed in 7.2.11
• 7.3 release candidates: through 7.3-rc6 → fixed in 7.3-rc7

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.

If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits:
- a464d95
- 0fab003
- 94524b7
- a65f69e
- 32a8b0a
- f3e835a
- c3e3346
- 6785011

Intel 8087 chip introduced in 1980 significantly improved floating-point operations, with a speedup of almost 100 times over the 8086 processor. The microcode implementation of addition and subtraction involves complex logic to handle special cases such as infinities, zeros, and NaN values.

Broadcom’s legacy WPS Monitor software mishandles fragmented WPS setup messages carried over EAP. Its length checks don’t adequately constrain the reassembled message to the actual destination buffer.

Who’s affected?
Routers/access points using the vulnerable legacy Broadcom component, across both eCos and Linux firmware. Having a Broadcom chip alone does not establish vulnerability; the exact software and hardware revision matter.

device list (just some examples):
TP-Link: VR1600, TD-VG5612, Archer C3150, C5400, VR600, VR900, VR2800
Cisco: elected RV routers and WAP access points.

Broadcom stated that it replaced WPS Monitor with hostapd starting in 2018. Device owners need a firmware update from their OEM or ISP; older eCos-based products may have no migration path.

there is also no CVE assigned for this. Broadcom declined to request a CVE, stating that the affected software was obsolete and outside its support window.

go get go@1.27.3

sed -i \
  -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
  -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
  /etc/ca-certificates.conf && update-ca-certificates