CVE-2026-72353

A flaw was found in the Linux kernel's NTFS file system driver. A use-after-free vulnerability exists in the ntfsattrfallocate function, where a runlist element is accessed after its memory has been deallocated by a concurrent operation. A local attacker could exploit this to trigger a system...

CVE-2026-72345

A flaw was found in the Linux kernel's mlx5 LAG Link Aggregation Group driver. An off-by-one error in the mlx5lagcreatesinglefdb function's error rollback mechanism can lead to operations on uninitialized memory or a double-free condition. This could result in system instability or a denial of...

CVE-2026-72449

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged render-group user can exploit this vulnerability via /dev/kfd by repeatedly calling AMDKFDIOCCRIUOP. This leads to a use-after-free and double-free condition due to improper list handling during cleanup. Successful...

CVE-2026-74569

A flaw was found in the Linux kernel's netfilter Session Initiation Protocol SIP connection tracking module nfconntracksip. A remote attacker could send specially crafted SIP messages that cause an integer overflow during Network Address Translation NAT rewrite delta calculations. This overflow...

CVE-2026-64832

A flaw was found in FFmpeg, specifically within the NVIDIA NVDEC hardware decoder. A remote attacker could exploit this double-free vulnerability by providing a specially crafted video file. This can lead to memory corruption, potentially allowing for arbitrary code execution or causing a denial ...

CVE-2026-72484

A flaw was found in the Linux kernel, specifically within the staging: most: video subsystem. This vulnerability occurs when compregistervideodev attempts to release a videodevice that might have already been freed during a failed device registration. A local attacker could exploit this double fr...

CVE-2026-72476

A flaw was found in the dmaengine component of the Linux kernel. This flaw occurs in the dmareleasechannel function due to an incorrect order of operations, where a channel's reference count is decremented before verifying if the device is still in use. This can lead to a use-after-free...

CVE-2026-74488

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When parsing Tunneled Direct Link Setup TDLS frames within an Aggregated MAC Service Data Unit A-MSDU, the driver incorrectly uses the length of the parent frame instead of the subframe. This error can lead to a use-after-free...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

USN-8563-3 nginx vulnerability

USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly...

CVE-2026-76045

A flaw was found in WebGL in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a high-severity security risk...

CVE-2026-74320

A flaw was found in the fbdev: sm501fb component of the Linux kernel. The code responsible for obtaining frame buffer mode information from Open Firmware OF binding contains multiple memory handling errors. These include use-after-free vulnerabilities, buffer overruns when writing mode strings...

CVE-2026-74369

A flaw was found in the Linux kernel's liveupdate component. This use-after-free vulnerability occurs due to an incorrect order of operations when managing file handler modules. Specifically, the system attempts to access module operations after the module's reference count has been decremented,...

Security update for python313

This update for python313 fixes the following issues: CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. CVE-2026-0864: improper handling of...

CVE-2026-76040

A flaw was found in chromium-browser. This use-after-free vulnerability allows a remote attacker, through social engineering, to execute arbitrary code outside of the sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-58083

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

CVE-2026-74314

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability arises from improper handling of special fields during the recycling of map values, which can lead to unsafe destruction operations. Specifically, in tracing programs operating within a Non-Maskable...

CVE-2026-58083

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

EUVD-2026-62351

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...