CVE-2026-58084 Kernel stack disclosure via timer_settime(2)

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

EUVD-2026-62338

To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...

CVE-2026-58084

FreeBSD 15.0 and 15.1 are affected by a kernel stack disclosure in the POSIX interval timer subsystem (ktimer). When an unprivileged local user calls timer_settime(2) with a non-NULL old_value argument on a CLOCK_TAI timer, the kernel invokes realtimer_gettime() to retrieve the previous timer val...

CVE-2026-72432

A flaw was found in the Linux kernel's Trusted Platform Module TPM Command Response Buffer CRB driver. This vulnerability occurs because the driver does not properly check for the presence of an Advanced Configuration and Power Interface ACPI companion object during device probing. An attacker...

CVE-2026-72352

A flaw was found in the Linux kernel's Human Interface Device HID Berkeley Packet Filter BPF component. An integer overflow, where a calculation exceeds the maximum value an integer type can store, in the hidbpfgetdata function's range check can occur when processing a very large size value. This...

CVE-2026-72461

A flaw was found in the AppArmor security module of the Linux kernel. This vulnerability, a reference count leak when updating the skctx, occurs because a reference is unconditionally put by the caller even when it has been transferred. A local attacker could exploit this flaw to cause a denial o...

CVE-2026-72440

A flaw was found in the Linux kernel's RAID1 Redundant Array of Independent Disks Level 1 implementation. During write failures, the md/raid1 module may fail to release writespending and barrier references. This oversight can lead to a resource leak, potentially causing system instability or a...

CVE-2026-72456

A flaw was found in AppArmor within the Linux kernel. When the getcurrentexepath function encounters a path resolution failure, it fails to properly release file and path references. This resource leak could be exploited by a local attacker, potentially leading to a Denial of Service DoS by...

CVE-2026-49425

CVE-2026-49425 is a kernel stack information disclosure in the FreeBSD compat32 subsystem (the 32-bit compatibility layer for 64-bit platforms). The kevent() handler translates a 64-bit kevent struct into a stack-declared 32-bit struct without first zeroing it , allowing an unprivileged local use...

CVE-2026-49425 Kernel stack disclosure in 32-bit compatibility support

The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...

EUVD-2026-62345

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-49424 Kernel stack disclosure in Linux compatibility layer

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-72400

A flaw was found in the Linux kernel's Segment Routing over IPv6 SEG6 component. Insufficient validation of the Segment Routing Header SRH length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF Berkeley Packet Filter program, could...

CVE-2026-49423 Remote DOS via uninitialized memory access in KTLS receive

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

CVE-2026-72380

A flaw was found in the Linux kernel's xen/pvcalls component. A malicious or buggy backend could send a specially crafted request identifier that, when processed, would lead to an out-of-bounds write. This could result in memory corruption and potentially cause the frontend to stop trusting the...

CVE-2026-72374

A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This...

CVE-2026-72459

A flaw was found in the AppArmor security module of the Linux kernel. The aalabelalloc function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability...

CVE-2026-72372

A flaw was found in the AFS Andrew File System component of the Linux kernel. This vulnerability arises from insufficient locking mechanisms when modifying internal data structures related to dynamic inode management. An attacker could potentially exploit this weakness, leading to system...

CVE-2026-49428

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49421

The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses ATRESOLVEBENEATH with unlinkat2 or...