Fuzzing-Driven Vulnerability Research Exposes One-Packet and Protocol DoS Risks

Researchers reported CVE-2026-70111, a reproducible one-packet Windows Server denial of service found by fuzzing DFS referral handling; internal SMB traffic may evade metadata-only monitoring, while a possible privilege-escalation path is not confirmed as code execution. Newly disclosed libtirpc CVE-2026-85977 can exhaust clients using pmap_getmaps() through crafted PMAPPROC_DUMP replies; exploitation is not confirmed. Linux 7.4 development also adds Intel Instruction Timeout and Bus Lock VM Exit support against hostile TDX guest resource starvation.