CVE-2026-74690

CVE-2026-74690 is a Use-After-Free (UAF) vulnerability in the Linux kernel's s390/ism (Integrated Service Management) driver. During ism_dev_exit(), an active ISM interrupt handler can access the sba and ieq data structures after they have been freed. The fix calls free_irq() to drain in-flight i...

CVE-2026-74690 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

CVE-2026-74690 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

EUVD-2026-64377

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

EUVD-2026-64589

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652

A use-after-free vulnerability in the Linux kernel's amba-pl011 serial driver affects the RS485 trigger high-resolution timers (hrtimers). These timers are embedded in the devm-managed port and can fire after the port is freed, because the IRQ handler may arm a timer before the timers are cancele...

EUVD-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

EUVD-2026-64566

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmbclientidarr A dibs device interrupt handler can be active after dibsdevdel and may still access dmbclientidarr. UAF In case of a failure in dibsdevadd being called by dibslodevprobe dmbclientidarr ...

CVE-2026-74629

CVE-2026-74629 affects the Linux kernel's dibs (Device In-Band Signaling) subsystem and involves two memory-management defects in the lifecycle of dmb_clientid_arr. First, a use-after-free occurs when a dibs device interrupt handler remains active after dibs_dev_del() and continues to access the ...

CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-74617

CVE-2026-74617 affects the Linux kernel 's dibs device driver. The root cause is that dibs->lock was initialised in dibs_dev_add(), but a dibs device can already receive interrupts before that call: ism_probe() invokes ism_dev_init() (which calls request_irq()) prior to dibs_dev_add(). A GID e...

CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

EUVD-2026-64554

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

UBUNTU-CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +8383 more potentially affected by CVE-2026-62243 via io.netty:netty-handler (>=4.2.0.final, <=4.2.16.final)

io.netty:netty-handler MAVEN version =4.2.0.final, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta, =0.6.4, =0.6.4, =1.3.0-beta and more Source cves: CVE-2026-62243 Source advisory: MEND:CVE-2026-62243...

EUVD-2026-64271

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...