3 lessons from frontier AI vulnerability research

In this article 1. Shift 1. From frontier capability to scale 2. Shift 2. From token consumption to reasoning economics 3. Shift 3. Validation and remediation as a continuous learning loop 4. Transferring security research to help open source projects 5. Open-source vulnerability reporting snapsh...

CVE-2026-80902

A flaw was found in the Linux kernel's sun6i-dma component. When Direct Memory Access DMA transfers are terminated, active descriptors are not correctly reclaimed. This issue leads to a permanent memory leak and can also cause corruption of internal data structures within the kernel...

CVE-2026-80903

A flaw was found in the Linux kernel's Direct Rendering Manager DRM Xe output/audio OA module. When a specific configuration emission function fails, it does not properly release allocated memory for synchronization entries. This oversight leads to a memory leak, where system memory becomes...

CVE-2026-80885

A flaw was found in the Linux kernel's Andrew File System AFS component. The rxrpc Out-of-Band OOB message handler did not properly cancel its processing. This could lead to the handler continuing to process messages even when the network namespace is no longer active, or mishandling security...

Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. CVE-2026-63920: ipv6: validate extension header length...

DEBIAN-CVE-2026-98374

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

CVE-2026-98374

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

AZL-106734 CVE-2026-98374 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

CVE-2026-98373

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

DEBIAN-CVE-2026-98373

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

CVE-2026-98374

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

CVE-2026-98374 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

CVE-2026-98374 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

EUVD-2026-94323

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...

CVE-2026-98374

The Linux kernel is vulnerable to a use-after-free flaw in the tcp_send_synack() function. The issue occurs because the function frees the original cloned SYN skb using tcp_rtx_queue_unlink_and_free() but fails to update tp->retransmit_skb_hint, which continues to point at the freed skbuff_fcl...

CVE-2026-98373

The Linux kernel contains a vulnerability in the mm/hugetlb component related to the move_hugetlb_page_tables() function. The root cause is an incorrect logic error where the function advances both source and destination addresses to the last entries of their respective page tables when a source ...

EUVD-2026-94322

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

CVE-2026-98373 mm/hugetlb: preserve mremap address delta when skipping page tables

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

CVE-2026-98373 mm/hugetlb: preserve mremap address delta when skipping page tables

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...

kernel: packet: use consistent hard_header_len in non-ring send paths

An out-of-bounds write problem was observed in packetsendmsgspkt in net/packet/afpacket.c in the Linux Kernel. In this flaw, AFPACKET hardheaderlen race may allow local privilege escalation...