Information Exposure

org.eclipse.jetty, jetty-server is vulnerable to Information Exposure. The vulnerability is due to improper handling of HTTP/1.1 request trailers, where trailers from a previous request are retained and reused across subsequent requests on the same connection, which allows an attacker to access o...

HTTP Request Smuggling

io.netty, netty-codec-http is vulnerable to HTTP Request Smuggling. The vulnerability is due to the WebSocket V07/V08 handshaker accepting a WebSocket upgrade request without requiring the Connection: Upgrade and Upgrade: websocket headers, which allows an attacker to force an unrecognized protoc...

SUSE CVE-2026-64412

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to requestmodule...

SUSE CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

CVE-2026-64500

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its interrupt handler with devmrequestirq before it initializes...

CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

CVE-2026-64426

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

CVE-2026-64412

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to requestmodule...

CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

UBUNTU-CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

UBUNTU-CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

UBUNTU-CVE-2026-64412

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to requestmodule...

UBUNTU-CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64312

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the child AEAD request before trying to submit it through padata. If padatadoparallel returns -EBUSY, pcrypt falls back to calling the...

UBUNTU-CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

UBUNTU-CVE-2026-64268

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

UBUNTU-CVE-2026-64500

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its interrupt handler with devmrequestirq before it initializes...