CVE-2026-62427 sysctl and platform-op locks open to abuse

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62426

The Xen hypervisor is vulnerable to a security issue where sysctl and platform-op locks are open to abuse. The root cause is that while system-wide locks are used for parallel-insensitive operations, the acquisition method lacks fairness , and under XSM/Flask , lock acquisition may occur before p...

correct buffer checks for DM_OP hypercalls

ISSUE DESCRIPTION Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized. IMPACT A device model of a...

sysctl and platform-op locks open to abuse

ISSUE DESCRIPTION To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any...

USN-8619-1 linux-hwe-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

CVE-2026-15012

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

PT-2026-65470

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists during the processing of grant-copy operations where a grant may be pinned if it is already in use by another operation, such as a mapping or...

PT-2026-65474

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The EVTCHNOP expand array hypercall checks if FIFO event channels are enabled without holding the required lock. This creates a race condition with EVTCHNOP rese...

PT-2026-65475

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Parts of the DM OP handling code assume the caller has provided the required number of buffers for a given operation without performing any validation. This lac...

PT-2026-65469

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

PT-2026-65564

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...

Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management RMM tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming...

EUVD-2026-49135

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

PT-2026-65349

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...

CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

UBUNTU-CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU

...

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

...

smb: client: fix double-free in SMB2_flush() replay

...

SUSE CVE-2026-64298

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...