CVE-2026-128987

A flaw in dbus allows a local attacker to cause a denial of service (DoS) by triggering an infinite CPU-spin loop. The vulnerability occurs when an attacker connects to an affected service, requests a response, and stops socket reads while maintaining the connection. The socket transport incorrec...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Since nothing requires the offsets to advance, a modem pointing an NDP at itself or at an earlier NDP caus...

BIT-PILLOW-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

UBUNTU-CVE-2026-99130

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

CVE-2026-99130

The Linux kernel contains a vulnerability in io_uring where io_uring_cancel_generic() fails to sleep when a task's tctx has pending local work that the exiting task cannot run. This occurs specifically with rings that were IORING_SETUP_R_DISABLED during creation but were later enabled by a differ...

CVE-2026-99130 io_uring/cancel: don't spin on local work the task can't run

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

PT-2026-128123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring cancel generic function where it refuses to sleep while any ring on the exiting task's tctx has local work pending. This occurs when a ring was set to...

Linux Distros Unpatched Vulnerability : CVE-2026-99130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work...

GHSA-3J72-P6QG-6XP7 Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642

The Pillow Python imaging library is vulnerable to an infinite CPU-spin loop in the TarIO initializer (located in src/PIL/TarIO.py) in versions prior to 13.0.0 . The root cause is the acceptance of a negative octal member size , which triggers a backward seek that returns to the same 512-byte hea...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

Bytedeco JavaCV numerical error vulnerability

Bytedeco JavaCV versions prior to 1.5.14 have a numerical error vulnerability. This vulnerability stems from IPCameraFrameGrabber not checking for overflow or limiting the Content-Length when doubling the 32-bit buffer capacity. Malicious camera endpoints or tampered plaintext streams can return ...

PT-2026-96391

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph parse deleg inos ceph parse deleg inos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-64290

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

GHSA-RWM7-X88C-3G2P Netty epoll transport denial of service via RST on half-closed TCP connection

Summary Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. Affected versions All versions of 4.2.x...

Netty epoll transport denial of service via RST on half-closed TCP connection

Summary Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. Affected versions All versions of 4.2.x...

PT-2026-38280

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.0.Final through 4.2.12.Final Description Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed. This occurs when a connection has ALLOW HALF CLOSURE enabled or is in a...