EUVD-2026-62255

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49427 posixshm: largepage shared memory objects not explicitly wired

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...

CVE-2026-49427 posixshm: largepage shared memory objects not explicitly wired

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...

CVE-2026-49427

The FreeBSD kernel's posixshm module contains a vulnerability where pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmits such an object with the SF_NOCACHE flag, it incorrectly frees the underlying pages while existing mappings still refer to th...

EUVD-2026-62240

The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...

CVE-2026-49430

The OpenZFS component in FreeBSD contains a kernel memory corruption vulnerability (integer overflow) within the ZFS_IOC_RECV_NEW ioctl in the heal receive path. The issue arises because a 64-bit payload size is truncated to a 32-bit integer for memory allocation, but the original 64-bit size is ...

EUVD-2026-62239

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

PT-2026-78596

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description An out-of-bounds read allows a remote attacker to disclose kernel memory. An out-of-bounds read occurs when a program reads data past the end of the intended buffer,...

PT-2026-78660

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-16833: Out-of-bounds Read

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read...

PT-2026-78685

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6 nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handle ra 6co the 8-bit context len field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...

CVE-2026-49428: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49430: Heap-based Buffer Overflow

The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...

Linux Distros Unpatched Vulnerability : CVE-2026-74298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the...

SUSE CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

CVE-2026-65349

creationtimestamp| type| source ---|---|--- 2026-08-18 04:50:07+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818 2026-08-18 08:48:38+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2020 2026-09-03 12:00:05+00:00| seen|...

CVE-2026-65351

creationtimestamp| type| source ---|---|--- 2026-08-18 04:45:03+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260818 2026-08-18 08:48:41+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2020 2026-09-15 20:48:13+00:00| seen|...

EUVD-2026-60480

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...

Linux Distros Unpatched Vulnerability : CVE-2026-72014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101965)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101965 advisory. In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume...