CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98647

The Linux kernel contains a divide-by-zero vulnerability in the btf_struct_walk() function. The issue occurs when a BPF program access goes past a structure where the last member is a flexible array ; the function fails to verify that the element type has a non-zero size before performing a modul...

CVE-2026-98647: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

Malicious code in hardhat-roof (npm)

Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast, logger, stream, json' — but the package name is 'hardhat-roof'...

MAL-2026-17509 Malicious code in hardhat-roof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast,...

Malicious code in chromatitle-js (npm)

Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with javascript-obfuscator 400-entry rotating string-array decoder,...

Important: perl-YAML

Issue Overview: Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Affected Packages: perl-YAML Issue Correction: Run dnf update perl-YAML --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2151 --releasever 2023.12.20260914 to update your system. Mor...

Amazon Linux 2 : perl-YAML (ALAS-2026-3918)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3918 advisory. Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Tenable has extracted the preceding description blo...

Important: perl-YAML

Issue Overview: Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Affected Packages: perl-YAML Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

Malicious code in sonmors (npm)

Source: amazon-inspector 66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca Package sonmors ships a near-copy of the sonner React toast library and spoofs sonner's identity in package.json author Emil Kowalski , homepage sonner.emilkowal.ski, repository github.com/emilkowalski/sonne...

Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

MAL-2026-14208 Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

CVE-2026-74338

CVE-2026-74338 concerns the Linux kernel: a BPF_LSM_CGROUP sleepable program could be loaded in a context where sleeping is disallowed, triggering a BUG from sleeping in an invalid context during file_open. The fix adds verifier support to reject loading sleepable BPF_LSM_CGROUP programs destined...

CVE-2026-74338 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

Malicious code in cdktn-provider-azurerm (PyPI)

Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf → cdktn and fabricated 'CDK Terrain' branding at cdktn.io...

MAL-2026-13461 Malicious code in supersig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5 The published dist bundles dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js, reached via the package's main/module/browser entries on...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-13298 Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...

MAL-2026-13131 Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...