block_buffer: panic corrupts inline buffer position

Summary A caught panic may leave the cursor position of EagerBuffer or ReadBuffer in a corrupted state; this in turn allows out-of-bounds reads/writes. Details & PoC The following two tests fail miri: rust cfgmiri test fn eagerdigestblockspaniccorruptsinlineposition // EagerBuffer stores its curs...

CVE-2026-72485

A flaw was found in the Linux kernel's coresight platform component. The functions responsible for adding input and output connections increment internal counters before successfully allocating memory. If a memory allocation fails, these counters become inconsistent with the actual state of...

CVE-2026-72369

A flaw was found in the Linux kernel's Minix filesystem. A local attacker can exploit this vulnerability by mounting a specially crafted Minix v3 image. This image can contain specific inode or zone counts that trigger an integer overflow during the calculation of bitmap block counts. The overflo...

CVE-2026-72394

A flaw was found in the Linux kernel's aspeed-g6-pwm-tach driver. This vulnerability arises when the system attempts to calculate fan rotations per minute RPM using a tachometer value of zero, which can occur due to hardware glitches or specific conditions. Without proper validation, this zero...

CVE-2026-74472

A flaw was found in the Linux kernel's ublk driver. This vulnerability arises from improper initialization of kernel-owned device information fields when a new ublk device is added. A local attacker could exploit this by providing malformed device information, which may lead to a kernel panic,...

CVE-2026-76234

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234

libcrux-ecdh (before 0.0.6) had broken X25519 length/clamping validation; libcrux-ed25519 (before 0.0.6) duplicated clamping during key generation; libcrux-psq (before 0.0.7) panicked instead of propagating AEADError. CVSS 3.1 scores availability impact HIGH (7.5) and CVSS 4.0 scores 8.7. No expl...

CVE-2026-49423

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

EUVD-2026-62344

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

CVE-2026-49423

FreeBSD 's KTLS (Kernel TLS) subsystem contains an uninitialized memory access in ktls_ocf_tls_cbc_decrypt(). When building the iovec array for a received TLS 1.2 CBC record, the function incremented the index for every mbuf in the chain, including those skipped because they held only the 5-byte ...

CVE-2026-49419

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-49419 Jail reference count underflow

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-72334

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream handling. A remote attacker, by sending specially crafted malformed Bluetooth ISO packets, could trigger a kernel panic, leading to a denial of service. Additionally, this vulnerability could result in a memory leak within th...

CVE-2026-52829

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 ...

CVE-2026-52739

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52738

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalizedstate/zebradb/transparent.rs, the finalized-state writer originally appli...

CVE-2026-52731

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/longpoll.rs, LongPollId::fromstr...

CVE-2026-52829 ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 ...

CVE-2026-52829

An unauthenticated remote peer can deterministically crash any synced zebrad node (v4.4.1 and earlier) on the default Linux dual-stack listener by completing a P2P handshake and advertising an invalid mempool transaction; the crash fires after the 30-second misbehavior batch flush due to an IPv4-...