36 matches found
CVE-2026-113714
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...
CVE-2026-113714
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...
CVE-2026-93317
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...
CVE-2026-93317
The buildkit software (referenced via the Moby project) is vulnerable to a flaw where an unauthenticated attacker controlling a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows the resulting snapshot to be cached under the incorrect di...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fixed a potential UAF Uninitialized Address Fault when the ddgst mismatch occurs. Shivam Kumar identified this vulnerability through vulnerability testing: When the data digest is enabled on an NVMe/TCP connection, and...
CVE-2026-64534
A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...
SUSE CVE-2026-64534
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...
SUSE CVE-2026-64535
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
CVE-2026-64535
A use-after-free flaw was found in the Linux kernel's NVMe-over-Fabrics TCP target nvmet-tcp driver. When NVMe/TCP data digest is enabled and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based write transfer, the digest error handler in nvmettcptryrecvddgst calls...
CVE-2026-64535
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
UBUNTU-CVE-2026-64534
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...
UBUNTU-CVE-2026-64535
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
CVE-2026-64535
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
CVE-2026-64535 nvmet-tcp: Fix potential UAF when ddgst mismatch
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
CVE-2026-64535 nvmet-tcp: Fix potential UAF when ddgst mismatch
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
CVE-2026-64535
CVE-2026-64535 affects the Linux kernel nvmet-tcp (NVMe over Fabrics TCP target). Root cause: when data digest is enabled and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() which does percpu_ref_put() but does...
EUVD-2026-49113
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...
Linux Distros Unpatched Vulnerability : CVE-2026-64535
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testin...
PT-2026-64859
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the nvmet-tcp module. When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C DATA PDU during an...
CVE-2026-31830
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...