bpf: Prevent tailcall infinite loop caused by freplace

...

ksmbd: fix use-after-free in ksmbd_session_rpc_open

...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a miscalculation of the jump offset in the LoongArch architecture BPF tail call, which could lead to a soft...

VulnCheck KEV: CVE-2025-42957

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

SUNRPC: fix a memleak in gss_import_v2_context

...

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

...

netfs: Only call folio_start_fscache() one time for each folio

...

CVE-2025-21026

Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call...

CVE-2025-21026

CVE-2025-21026 affects Samsung Mobile and Android environments via ImsService. The root cause is improper handling of insufficient permissions, enabling a local attacker to interrupt calls on affected builds prior to SMR Sep-2025 Release 1. The vulnerability spans ImsService code paths and is mit...

Samsung Mobile Devices security vulnerabilities

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Sep-2025 Release 1, which stems from mishandling of permissions and...

VulnCheck KEV: CVE-2023-32629

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovlcopyupmetainodedata skip permission checks when calling ovldosetxattr on Ubuntu kernels...

CVE-2025-21026: Undefined Security Weakness

Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call...

CVE-2025-22419

In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2025-22419

In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2025-22419

In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2025-22419

Google Android is affected by an elevation of privilege vulnerability (CVE-2025-22419 ) where an attacker can use a tapjacking or overlay attack to mislead users into enabling malicious phone call forwarding. This vulnerability requires user interaction and User execution privileges for exploitat...

CVE-2025-22419

In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2025-22419

In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2025-46810

A flaw was found in the traefik2 package of OpenSUSE and its derived distributions. This issue occurs due to an insecure chown call in the %post section of the traefik2 package, allowing the traefik user to obtain ownership of arbitrary files on the system when the traefik2 package is reinstalled...

CVE-2025-52548

E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...