CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

CVE-2026-68330

CVE-2026-68330 relates to the Linux kernel net/airoha NPU mailbox handling. The issue arises because airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, while some callers expect the NPU to write the response back into the same buffer. On non‑cache‑coherent architectures (e.g...

EUVD-2026-55334

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68233 drm/vc4: Shut down BO cache timer before teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68233

In the Linux kernel DRM/VC4 subsystem, CVE-2026-68233 addresses a use-after-free-like race where a timer callback (BO cache timer) can be rearmed by time_work during teardown. vc4_bo_cache_destroy() deletes the timer and cancels the work, but the cancelled work can rearm the timer and queue work ...

CVE-2026-68168

The CVE describes a Linux kernel AFS fix: afs_edit_dir_remove() now uses afs_dir_get_block() to obtain block 0 instead of afs_dir_find_block(), because the latter caches the found block in afs_dir_iter and can switch the page if a subsequent find occurs. This change aligns with the existing afs_e...

EUVD-2026-55554

In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...

EUVD-2026-55534

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68149

The CVE-2026-68149 entry pertains to a Linux kernel bug in ACL_DONT_CACHE handling within forget_cached_acl(). The issue arises when ACL_DONT_CACHE state is unintentionally invalidated, affecting inodes for filesystems opting out of POSIX ACL caching. Specifically, in fuse-related paths, forget_a...

CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-45673, CVE-2026-45674, CVE-2026-47691 Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers an...

CVE-2026-68086 mm/khugepaged: write all dirty file folios when collapsing

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing There is no upstream commit, as this code was removed by upstream commit 044925f9b565 "mm: fs: remove filemapnrthps functions and their users" As-is, khugepaged and...

CVE-2026-68086

Technical details about CVE-2026-68086 are not publicly available in the provided documents. No concrete impact, affected products, versions, or fixes are specified here. Monitor for updates.

EUVD-2026-55267

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing There is no upstream commit, as this code was removed by upstream commit 044925f9b565 "mm: fs: remove filemapnrthps functions and their users" As-is, khugepaged and...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...