CVE-2026-64292 iommufd: Move vevent memory allocation outside spinlock

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

EUVD-2026-48751

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-64323: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Linux Distros Unpatched Vulnerability : CVE-2026-64442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference...

Rendering on Real Silicon: GPU Render-Timing As a Passive, AI-Resistant CAPTCHA Signal

Conventional CAPTCHAs pose puzzles that modern AI systems increasingly solve, while behavioral and cryptographic-attestation defenses carry privacy or enrollment costs. We investigate an orthogonal signal: the physical timing behavior of a client's GPU under a controlled WebGL rendering workload...

PT-2026-64673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the 6lowpan implementation. The function lowpan nhc do uncompression retrieves an NHC descriptor while holding the lowpan nhc lock. If the descriptor lac...

PT-2026-64544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur when mounting a crafted UDF image with a virtual VAT partition. The udf load vat function fails to validate the lengthHeader value from the on-disk VAT 2....

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes...

PT-2026-64726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the RNDIS Remote Network Driver Interface Specification gadget function. The rndis rm hdr function fails to verify the length of the RNDIS header before accessing its...

PT-2026-64513

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the iommufd component, memory allocation for veventq occurs inside a spinlock. Because the queue depth is determined by user space, a user can allocate excessively large queues to...

Linux Distros Unpatched Vulnerability : CVE-2026-56746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

Linux Distros Unpatched Vulnerability : CVE-2026-55833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding...

Linux Distros Unpatched Vulnerability : CVE-2026-66139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...

PT-2026-64514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd veventq fops read function where a bound-check for the normal vEVENT path incorrectly uses sizeofhdr instead of sizeofhdr. Because hdr is a pointer,...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339 Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...