CVE-2026-89889

A flaw was found in the Linux kernel's i2c imx415 media driver. When programming VMAX fails, the VBLANK path returns immediately without releasing a previously acquired runtime power management PM reference. This oversight can lead to a resource leak, potentially allowing a local attacker to caus...

CVE-2026-89881

A flaw was found in the rtl2832sdr driver within the Linux kernel. When a USB device using this driver is disconnected, the driver prematurely clears a critical device pointer. This prevents the proper release of Direct Memory Access DMA stream buffers and USB Request Blocks URBs when the user...

CVE-2026-89867

A flaw was found in the Linux kernel's media subsystem, specifically within the chips-media wave5 driver. This vulnerability occurs when multiple video decoder instances share a video processing unit VPU and a job slot is not properly released during the draining process, particularly if a decode...

CVE-2026-89824

A flaw was found in the drm/panel-edp component of the Linux kernel. This vulnerability occurs due to an i2c adapter reference leak during probe failure or driver unbind, especially when a device tree redundantly uses the 'ddc-i2c-bus' property. This resource leak could potentially lead to system...

Security Bulletin: Due to the use of Spring WebFlux, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-47883, CVE-2026-47885, CVE-2026-47889, CVE-2026-47891 )

Summary Spring WebFlux is used by IBM Sterling Control Center and as part of dependency one of them is in spring-web-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

CVE-2026-93102

A flaw was found in the Linux kernel's RDMA/hfi1 driver. During a late probe failure, the hfi1initdd function allocates shared RX support, but if subsequent initialization or device registration fails, the allocated memory is not properly freed. This oversight can lead to a memory leak, potential...

CVE-2026-93083

A flaw was found in the armscmi firmware component of the Linux kernel. When the mailboxchansetup function attempts to set up a unidirectional transmit TX receiver channel, it may fail to properly release the primary channel if the secondary channel request fails. This resource leak can leave the...

CVE-2026-90188

A flaw was found in the Linux kernel's nullblk module. When sharedtags is enabled and device creation fails after allocating a global tag set, the global tag set is not properly freed. This oversight leads to a permanent memory leak, which could potentially result in a Denial of Service DoS due t...

CVE-2026-90424

A flaw was found in the Linux kernel, specifically within the iommu/tegra241-cmdqv driver. This vulnerability involves a resource leak during the initialization process of a component called VINTF0. If certain initialization steps fail, the VINTF0 resource is not properly released, leading to its...

CVE-2026-93090

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the setup of SCMI channels, a failure can occur where previously registered resources are not properly released. This oversight can lead to resource exhaustion, potentially causing system...

CVE-2026-93185

A flaw was found in the Linux kernel's audio subsystem, specifically within the SoundWire SDW driver for the rt700 codec. This vulnerability arises when a SoundWire device is removed, as the system may fail to properly cancel all pending tasks associated with the device. Consequently, an active...

CVE-2026-55266

In qsort of libufdtsysdepsvendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-105636

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-90077

A flaw was found in the Linux kernel's network net subsystem. An issue in the copynetns error handling path allows for resources allocated during network namespace creation to leak. This occurs because the preinitnet function returns prematurely, preventing proper resource deallocation. A local...

CVE-2026-90194

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI scan module. When a device fails to add, the system's rollback process does not properly clean up allocated bus IDs and instance numbers. This oversight can lead to a resource leak, potentially causing a Denial...

CVE-2026-90283

A flaw was found in the Linux kernel's hugetlbfs huge page file system component. When mounting hugetlbfs with specific size options, an error during root directory entry creation could lead to a subpool of huge pages not being properly released. This resource leak could allow a local attacker to...

CVE-2026-90138

A flaw was found in the Linux kernel's vsock implementation. A local attacker can trigger a failed self-connect on a vsock socket, which leaves a stale error state. Subsequent legitimate connection attempts to the same socket are then incorrectly rejected, leading to a Denial of Service DoS. This...

CVE-2026-90415

A flaw was found in the Linux kernel's RDMA/cxgb4 driver. This vulnerability occurs when the system fails to properly free a Steering Tag STAG index after an unsuccessful attempt to write to adapter memory. This leads to a resource leak, which could be exploited by a local attacker to cause a...