PT-2026-66551

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb malloc returns NULL before using placement new to construct an object at...

Linux Distros Unpatched Vulnerability : CVE-2026-53396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in...

CVE-2026-63733: Incorrect Authorization

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...

SUSE CVE-2026-53396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

CVE-2026-64185

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfsupdategroup is called for a named group and createfiles fails e.g. -ENOMEM, internalcreategroup calls kernfsremovekn on the group directory. In the update path, k...

CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-63909

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-64185

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfsupdategroup is called for a named group and createfiles fails e.g. -ENOMEM, internalcreategroup calls kernfsremovekn on the group directory. In the update path, k...

CVE-2026-64185 sysfs: don't remove existing directory on update failure

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfsupdategroup is called for a named group and createfiles fails e.g. -ENOMEM, internalcreategroup calls kernfsremovekn on the group directory. In the update path, k...

CVE-2026-64185

Technical details for CVE-2026-64185 are not publicly available in the provided documents. Monitor for official advisories; no product/vendor/version/root-cause/mitigation information is available here.

CVE-2026-64119

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-63944

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

CVE-2026-63944 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The conn pointer was obtained from an RCU-protected iteration over...

CVE-2026-63909 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

EUVD-2026-45682

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-63909 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-53395

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4create nfsd4create steals create-crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard...

CVE-2026-53396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

CVE-2026-53396

CVE-2026-53396 (Linux kernel, NFSd) : The issue arises in nfsd4_create_file() where two ACL-handling bugs allow potential ACL leakage and incorrect behavior on CREATE. Specifically, the return value of nfsd4_acl_to_attr() is discarded, so failed ACL conversions (e.g., -EINVAL for unsupported ACE ...