Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fixed a issue where shadow paging use-after-free occurred due to an unexpected role. Commit 0cb2af2ea66ad “KVM: x86: Fixed a issue where shadow paging use-after-free occurred due to an unexpected GFN” corrected a mismat...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

GHSA-HX4H-VR3M-45VH n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

Impact An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process, leading to a denial of service. Both self-hosted and cloud instances runni...

GHSA-Q3J5-8VRG-4P9Q n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

Impact An authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression. When an HTTP Header Auth credential is applied to a paginated request, the secret is present...

CVE-2026-63940

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit...

CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block GHCB scratch area. When processing Page State Change PS...

CVE-2026-64105

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architecture, specifically within the virtual Generic Interrupt Controller vgic component. When a virtual CPU vCPU fails to initialize, the private Interrupt ReQuests IRQs allocated for it are not properly released...

CVE-2026-63807

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 memory management unit MMU. A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead t...

CVE-2026-12080

CVE-2026-12080 affects the QEMU Guest Agent (qga). A local, unprivileged user can exploit the guest-ssh-add-authorized-keys handler by manipulating symbolic links through a deterministic directory-symlink bypass or a TOCTOU file-symlink race, enabling ownership of arbitrary root-owned files/direc...

Linux Distros Unpatched Vulnerability : CVE-2026-63937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when readin...

Linux Distros Unpatched Vulnerability : CVE-2026-63941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which...

Linux Distros Unpatched Vulnerability : CVE-2026-63940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area an...

EUVD-2026-45857

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h erratum 1235 Hygon Family 18h CPUs are derived from AMD Family 17h Zen1 silicon and share the same erratum 1235: hardware may read a stale IsRunning=1 bit during ICR...

CVE-2026-64115

CVE-2026-64115 affects the Linux kernel’s vsock/vmci component. The issue is a Use-After-Free caused when a peer resets a connection during the handshake, leading to a pending socket remaining in a listener’s pending list and the possibility of a crash/DoS. Root cause: vmci_transport_recv_connect...

CVE-2026-64115 vsock/vmci: fix UAF when peer resets connection during handshake

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64034

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-63939

CVE-2026-63939 (Linux kernel, KVM SEV): The issue concerns computation of the maximum length for the in-GHCB scratch area in the GHCB shared buffer. Previously, KVM assumed the input length (@len) always represented the maximum required size for MMIO emulation; for PSC requests, @len is only the ...

CVE-2026-63863

The CVE-2026-63863 entry concerns the Linux kernel drm/gpusvm subsystem. The issue is a unbalanced unlock of gpusvm notifier_lock detected during drm_gpusvm_scan_mm(), where a path under err_free calls drm_gpusvm_notifier_lock() after unlocking, leading to a bad unlock balance warning. Connected ...