CVE-2026-74378: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

PT-2026-72681

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during device unregistration, such as during a network namespace exit, where packets can bypass backlog flushing. This occurs because a lockless netif running che...

Linux Distros Unpatched Vulnerability : CVE-2026-74443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without...

PT-2026-72895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmw cmd dma function where the DMA suffix location is calculated without verifying if header-size is sufficient to contain both the cmd-body and the suffix. This...

CVE-2026-74443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

PT-2026-72806

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the luo session retrieve function. This occurs when a concurrent thread can release and free a session between the initial...

PT-2026-72526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the flower lockless approach during the sizing and filling of a flow rule buffer. This occurs because the cls flower...

PT-2026-72492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the sof ipc4 bytes put function. The copy size is derived from the existing data-size in the buffer instead of the size field of the...

PT-2026-72998

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A TOCTOU Time-of-Check to Time-of-Use issue exists in the adt7470 hardware monitoring driver. A race condition occurs when a concurrent update of the cached fan value happens between the...

CVE-2026-74546: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

CVE-2026-72304: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

Linux Distros Unpatched Vulnerability : CVE-2026-74546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it...

PT-2026-72814

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the RDMA/rxe component. The function get srq wqe reads the num sge variable from a shared receive queue buffer mapped into userspace...

CVE-2026-74370: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

Linux Distros Unpatched Vulnerability : CVE-2026-74378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validate...

Linux Distros Unpatched Vulnerability : CVE-2026-72338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and...

CVE-2026-72301: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

GHSA-9HGC-G3W5-67CM ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

PT-2026-75959

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...