golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-25687

CVE-2026-25687 affects the ZPA tunnel handler in Zscaler Client Connector (ZCC) . A race condition in this component leads to a heap corruption , enabling a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process. The CVSS 3.1 score is 8.1 (HIGH...

CVE-2026-25687 ZCC race condition in ZPA tunnel handler

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

CVE-2026-25687 ZCC race condition in ZPA tunnel handler

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

EUVD-2026-77536

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

CVE-2026-7208

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-5516)

Summary A security bypass vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-5516 DESCRIPTION: IBM WebSphere Application Server - Liberty 22.0.0.11...

CVE-2026-7208 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

CVE-2026-7208 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

CVE-2026-7208

Yealink SIP-T33G IP phones running firmware 124.86.x.x (prior to 124.87.0.0 ) are affected by a race condition in the runtime diagnostic subsystem. An authenticated attacker can trigger a diagnostic operation such as traceroute or ping and concurrently invoke the file-deletion endpoint to remove ...

EUVD-2026-77476

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: seeq: Fixed the use-after-free vulnerability in the ether3 driver due to race conditions. In the ether3probe function, a timer is initialized using a callback function called ether3ledoff, which is bound to &prevdev-timer...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntb: ntbhwswitchtec: Fixed a use-after-free vulnerability in switchtecntbremove due to a race condition. In the switchtecntbadd function, it is possible to call the switchtecntbinitsndev function. Then, &sndev-checklinkstatuswork...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

A use-after-free flaw was discovered in the Linux kernel due to a race condition in the unix garbage collector’s deletion of SKB races involving the unixstreamread generic function on the socket onto which the SKB is queued...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: fixed a race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr operates under the RCU lock, it still allows hlistforeachentryrcu to return an item that has already been removed from the list. The memory...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Fixed a race condition between netvscprobe and netvscremove. In commit ac5047671758 “hvnetvsc: Disabling NAPI before closing the VMBus channel”, napidisable was called for all channels, including all subchannels, withou...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: macintosh/machid: fixed a race condition in machidtoggleemumouse The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------ Cut here ------------ listadd double add:...

Astra Linux – Vulnerability in Linux 5.10, Linux

A issue was discovered in the Linux kernel through version 5.19.8. In the file drivers/firmware/efi/capsule-loader.c, there is a race condition that leads to a use-after-free situation...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: vmcihost: A race condition in vmcihostpoll was fixed, which caused a General Protection Fault. During fuzzing, a General Protection Fault was observed in vmcihostpoll. The General Protection Fault was likely due to dereferencing ...