WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors
The WireGuard kernel module does not preserve AllowedIPs entries for peers when duplicate prefixes are inserted. A server with multiple peers can lose routing information for earlier peers after a new peer is added with an overlapping AllowedIPs value, even though the on-disk configuration remains correct.
In the reported case, wg show displayed one peer with allowed ips: (none) while the other retained 10.100.0.0/24. The affected peer continued to complete handshakes and deliver inbound packets, yet outbound traffic failed after decryption, incrementing rx_frame_errors on the interface.
Root Cause in the AllowedIPs Trie
AllowedIPs are stored in a single struct allowedips trie belonging to the wg_device. Each peer holds only a list of back-references to trie nodes. When an exact match on both prefix and CIDR length occurs during insertion, the code executes:
- rcu_assign_pointer(node->peer, peer) — redirects the node to the new peer
- list_move_tail — removes the node from the previous peer’s allowedips_list
The operation returns success (0) with no warning, and neither wg nor wg-quick performs overlap checks.
Observed Symptoms and Affected Systems
The problem manifests differently depending on prefix length:
- Two peers with identical 10.100.0.0/24 — the first peer loses its entry
- One peer with 10.100.0.0/24 and another with 10.100.0.5/32 — both entries remain because lengths differ
Real-world reports include OpenWrt users adding mobile peers with 0.0.0.0/0, VyOS and OPNsense issues from 2020–2025, and Kubernetes clusters using Cilium or Calico where pod CIDRs are generated automatically.
Packet Handling and Diagnostics
Inbound packets from an orphaned peer are dropped after decryption with the message “Packet has unallowed src IP”, incrementing frame errors. Outbound packets to an address without a peer return ENOKEY (“Required key not available”) and increment tx_errors. Dynamic debug can surface the source-address message, but the overwrite itself produces no log entry.
The same trie-reassignment logic exists in wireguard-go, wireguard-nt, FreeBSD, and OpenBSD implementations, confirming the behavior is not Linux-specific.
Related articles
Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A single user created four separate accounts using valid Gmail address formats that all deliver to the same inbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com. Simple string comparison in the registration code treated these as distinct entries, allowing circumvention of new-user promotions, free-tier limits, and one-application-per-person rules. The root cause lies in three Gmail-specific behaviors: case-insensitive local parts, plus-addressing that ignores everything after the + symbol, and dots that carry no semantic meaning in the local part. Additional risks arise from IDNA homograph domains that visually mimic legitimate addresses but encode to different Punycode strings. Proper mitigation requires storing both the original email for delivery and a domain-aware normalized form for uniqueness checks, combined with explicit IDNA validation on registration.
Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing team requested reactivation of a three-year-old promotional landing page, only to discover that its domain now served an unrelated third-party website. The root cause was a forgotten CNAME record in the company's DNS zone that continued pointing to a project name on external hosting after the original service had been decommissioned. Because many hosting providers use wildcard DNS entries, standard availability checks and simple DNS resolution tests fail to detect that the target project no longer exists. Attackers who re-register the freed project name can then serve content under the company's legitimate subdomain, automatically obtaining valid TLS certificates and inheriting domain-wide cookies. The article details how such dangling records accumulate across infrastructure, marketing, and acquired company zones, and explains the concrete risks including cookie theft, bypass of Content-Security-Policy, and unauthorized domain ownership proofs. It concludes with a practical remediation workflow: export the full zone, assign owners to every record, validate external targets by application response rather than DNS resolution, and embed record removal into decommissioning procedures.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.