Time-of-check Time-of-use (TOCTOU) Race Condition

Apache Tomcat is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability is due to a race condition during the creation of Unix domain sockets, which allows an unauthorized local attacker to exploit the timing window and gain access to the Unix domain socket...

CVE-2026-101099 ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition

A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fi...

CVE-2026-101099

A vulnerability exists in the Kotlin Community SDK component of ag-ui-protocol ag-ui (up to 2026-09-23). The issue is located within the SseParser.kt file, where a specific manipulation can trigger the handling of exceptional conditions . This vulnerability may be exploited remotely . A pull requ...

CVE-2026-98153

A flaw was found in the Linux kernel's NVMe driver. A race condition can lead to a denial of service DoS or memory corruption when multiple paths scan the same shared namespace concurrently. Because access to the Flexible Data Placement FDP configuration data is unprotected during initialization,...

CVE-2026-93829

A flaw was found in the Linux kernel. A race condition exists in the Server Message Block SMB client during background worker thread creation, allowing a newly spawned thread to access connection session data before it has been completely initialized. A local user initiating an SMB connection can...

CVE-2026-97513

A flaw was found in the Linux kernel's Chips Wave5 video driver. A local user could trigger a Denial of Service DoS by causing a race condition during device release. When closing a video stream, the driver releases internal memory structures before removing the instance from the active list,...

GO-2026-6540 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

K000163436: Apache Tomcat vulnerabilities CVE-2026-73581, CVE-2026-76183, CVE-2026-77762, and CVE-2026-79677

Security Advisory Description CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M...

CVE-2026-93822

A flaw was found in the Linux kernel's Broadcom iProc PCIe controller driver. The driver fails to acquire the appropriate lock when stopping and removing a root bus. A local user with administrative privileges could exploit this race condition by initiating simultaneous PCI rescan or hotplug...

CVE-2026-93821

A flaw was found in the Linux kernel's Altera PCI Express PCIe controller driver. A local user could exploit a race condition during root bus removal by triggering concurrent device rescan or hotplug operations through the sysfs interface. This lack of proper synchronization can lead to a...

CVE-2026-93820

A flaw was found in the Linux kernel's Rockchip PCIe host controller driver. Stopping and removing a PCIe root bus without proper synchronization creates a race condition with concurrent device rescanning or hotplug operations. A local attacker could exploit this flaw to cause a use-after-free...

CVE-2026-93819

A flaw was found in the Linux kernel's MediaTek PCIe driver. The driver fails to acquire the proper lock while stopping and removing a root bus, allowing a race condition to occur alongside concurrent bus rescan or hotplug operations initiated via sysfs. A local user could exploit this race to...

CVE-2026-93818

A flaw was found in the Linux kernel's PLDA PCIe host controller driver. This vulnerability can result in a Denial of Service DoS caused by a race condition when removing a root bus without holding the required lock. A local user with administrative privileges can exploit this issue by triggering...

CVE-2026-93285

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. A race condition exists during filesystem remount or shutdown operations where background garbage collection tasks are improperly synchronized with teardown routines. A local user could exploit this timing flaw through...

CVE-2026-98130

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A race condition exists when starting an SCTP timer, where the timer can expire before it is reset, resulting in improper reference counting for the connection association. An attacker could exploit this...

CVE-2026-93279

A flaw was found in the Linux kernel's Octeon network driver. During network device shutdown or driver removal, a pending cleanup task may execute after associated network device structures have already been freed from memory. A local user could exploit this race condition during device teardown ...

glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader

A flaw was found in glibc, specifically within its dynamic loader ld.so. A local attacker can exploit a time-of-check to time-of-use TOCTOU race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DTRPATH for setuid/setgid programs,...

kernel: ext4: fix e4b bitmap inconsistency reports

A flaw was found in the Linux kernel's ext4 filesystem. A race condition exists between page migration and bitmap modification within the loadbuddy function. This can lead to bitmap inconsistencies and false positive corruption reports during certain workloads. This issue can affect data integrit...

CVE-2026-93278

A flaw was found in the Linux kernel's Octeon network driver. During interface shutdown, the driver deletes the packet polling mechanism without properly disabling it first, allowing active polling routines to continue running after interrupt handlers are released. A local attacker could exploit...

CVE-2026-98118

A flaw was found in the Linux kernel's netfs network filesystem subsystem. A local user could exploit a race condition during readahead operations to cause a Denial of Service DoS via a system crash. This issue stems from improper synchronization between the application thread and collector threa...