CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303

In CVE-2026-64303, a Linux kernel vulnerability in the fsl-lpspi driver occurs when dmaengine_prep_slave_sg() fails for the TX channel: the TX path is terminated but the RX path (already submitted) continues, unmapping buffers on -EINVAL and risking memory corruption or use-after-free. The fixed ...

CVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

Libssh: libssh: denial of service via zero advertised channel packet size

...

CVE-2021-28447

creationtimestamp| type| source ---|---|--- 2026-07-25 03:00:03+00:00| seen| https://t.me/binz0ne/395 2026-07-26 00:00:47+00:00| seen| https://t.me/binz0ne/395...

PT-2026-64524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fsl-lpspi SPI driver where the RX channel is not terminated when the TX prepare failure path is triggered. Specifically, if the dmaengine prep slave sg function...

PT-2026-64629

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep add connection reads the L2CAP connection without holding the channel lock, then passes its HCI device to register netdev. Controller teardown can clear and...

Linux Distros Unpatched Vulnerability : CVE-2026-64325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at...

PT-2026-64655

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap chan timeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading...

PT-2026-64546

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the mt76 WiFi driver when processing a channel-switch announcement CSA beacon. When cfg80211 queues a wiphy work item that calls the functions mt7921...

Linux Distros Unpatched Vulnerability : CVE-2026-64835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-64434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down whi...

Linux Distros Unpatched Vulnerability : CVE-2026-59850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already...

CVE-2026-48021

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...

DEBIAN-CVE-2026-66032

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containin...

EUVD-2026-42631

Open WebUI: /api/v1/channels/id/members exposes full user model including sensitive credentials...

GHSA-GH7P-78X6-JW6M Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Summary The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Summary The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...

GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...