CVE-2026-68417 RDMA/siw: publish QP after initialization

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

CVE-2026-68298

CVE-2026-68298 concerns the Linux kernel drm/xe/vm code. The vulnerability stems from an error path where, after a failed drm_gpuvm_resv_object_alloc(), resources allocated by xe_svm_init() could leak because xe_svm_fini() and xe_svm_close() were not always invoked for non-fault-mode VMs. The fix...

CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

CVE-2026-68294

In CVE-2026-68294, the Linux kernel QRTR (Qualcomm IPC Router) allows an unprivileged process to create an AF_QIPCRTR socket in a separate network namespace, due to global state (qrtr_local_nid and qrtr_ports) not being partitioned per namespace. This enables cross-namespace QRTR datagrams and co...

EUVD-2026-55345

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...

CVE-2026-68234

The CVE describes a bug in drm/amdgpu where amdgpu_bo_create_reserved pins and reserves a BO even when a non-NULL pointer is passed, leading to pin_count increments on repeated uses and eventual BO leaks because teardown unpins only once. The fix makes pinning occur only at creation, so repeated ...

EUVD-2026-55335

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

CVE-2026-68234 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

EUVD-2026-55484

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68083

CVE-2026-68083 affects ksmbd (Linux kernel in-kernel SMB server). The issue is a path-resolution bug in ksmbd_vfs_kern_path_create() where an SMB2 create/mkdir/hardlink path can leverage a ".." component to escape the share, because the rooted open lookup uses LOOKUP_BENEATH for the SMB2 path but...

CVE-2026-28672

creationtimestamp| type| source ---|---|--- 2026-08-10 10:59:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5if5ljlxwuhwj 2026-08-12 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyosmvz26...

CVE-2026-32227

creationtimestamp| type| source ---|---|--- 2026-08-10 10:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5f7k6npj4o7m5 2026-08-12 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyne5242g...

CVE-2026-40920

creationtimestamp| type| source ---|---|--- 2026-08-10 10:51:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/75pdqosvnbj3w 2026-08-12 16:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvlkkidh72v...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-66688

creationtimestamp| type| source ---|---|--- 2026-08-10 10:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspumcjnfd2w 2026-08-11 06:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrxo23v5r2w...

kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

CVE-2026-16257

The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...

CVE-2026-66703

creationtimestamp| type| source ---|---|--- 2026-08-10 07:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspkkg3zci2l 2026-08-11 03:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrnm6yfsw2f...

CVE-2026-18786 CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...