CVE-2026-72064

CVE-2026-72064 relates to the Linux kernel net: mana RX path. When frag_count > 1, RX buffers are allocated from page pool fragments and remain DMA mapped; the RX completion path omits dma_unmap_single(), so the implicit CPU sync is not performed before passing data to the networking stack. Th...

CVE-2026-72064 net: mana: Sync page pool RX frags for CPU

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

EUVD-2026-58978

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

CVE-2026-72020 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

CVE-2026-72020 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

CVE-2026-72020

CVE-2026-72020 affects the Linux kernel IP Virtual Server (IPVS) code. A bug in ip_vs_conn_new() caused only two ip_vs_seq members (in_seq and out_seq) to be reset, leaving init_seq and previous_delta uninitialized. For connections learned from a sync message, flags and data could be inconsistent...

EUVD-2026-59113

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...

EUVD-2026-58838

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip vs seq structs in ip vs conn new Commit 9a05475cebdd "ipvs: avoid kmem cache zalloc in ip vs conn new" changed ip vs conn new to allocate an ip vs conn object with kmem cache alloc. The function then initializ...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

PT-2026-72981

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect pa sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72253

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma...

PT-2026-72571

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr wq timer race in sctp free addr wq sctp free addr wq previously removed addr wq timer using timer delete while holding addr wq lock. However, timer delete does not guarantee that a currently running timer handler h...

PT-2026-72279

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna drm sync bo ioctl looks up args-handle in the ioctl caller's drm file. For SYNC DIRECT FROM DEVICE, it then calls amdxdna hwctx sync debug bo, but passes abo-client...

PT-2026-72961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue exists in the Bluetooth subsystem. The function hci find adv instance returns an adv info pointer that is only valid while hdev-lock is held. However,...