CVE-2026-90240

CVE-2026-90240 is a Linux kernel vulnerability in the Intel VT-d IOMMU driver. When tearing down DMA aliases, the functions domain_context_clear_one() and device_pasid_table_teardown() issued a context-cache invalidation using the device's own requester ID rather than the alias's bus/devfn . This...

CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

EUVD-2026-81833

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90064

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If suc...

GHSA-Q8HW-4FVP-9RWV Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...

firewalld security update

An update is available for firewalld. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list firewalld is a firewall service daemon that provides a dynamic customizable...

RLSA-2026:67585 Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization CVE-2026-4948 For more details about the security issues,...

MiracleLinux 9 : firewalld-1.3.4-20.el9_8 (AXSA:2026-1864:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1864:05 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the...

RockyLinux 9 : firewalld (RLSA-2026:67585)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67585 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the preceding...

CVE-2026-90240: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

The vulnerability of the system file `/cgi-bin/New_GUI/Set/Diagnostics.asp` of the Diagnostics component of the D-Link DSL-3782 microprogramming device allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /cgi-bin/NewGUI/Set/Diagnostics.asp function of the Diagnostics component of D-Link DSL-3782 router microprogramming software is related to the lack of data cleaning measures at the management level when processing the Addr parameter. Exploiting this vulnerability allows ...

CVE-2026-90242: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-61793: Improper Input Validation

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-90243: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-90241: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

UBUNTU-CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89817

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

Moderate: Red Hat Security Advisory: firewalld security update

An update for firewalld is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...