CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997: Improper Neutralization of Input During Web Page Generation

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-80819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80841 net/packet: defer vmalloc TX_RING free until skbs finish

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

CVE-2026-80841

CVE-2026-80841 is a use-after-free in the Linux kernel's AF_PACKET TX_RING subsystem. AF_PACKET TX_RING skbs hold a raw pointer to their ring frame; while page references preserve page-backed ring blocks after the ring vector is freed, they do not preserve a vmalloc mapping. This means a late skb...

EUVD-2026-71291

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

CVE-2026-80819 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

CVE-2026-80819 is a null pointer dereference in the Linux kernel 's Bluetooth RFCOMM subsystem. The flaw occurs when rfcomm_sock_recvmsg() calls rfcomm_dlc_accept() without holding rfcomm_mutex. A remote peer can trigger the bug by sending a DISC frame on a deferred-setup DLC, which clears d->...

CVE-2026-80819 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

EUVD-2026-71254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-85534

A flaw in libsoup 's HTTP/2 client can crash the process when a malicious server manipulates flow-control settings. When a client sends a request body from a non-pollable input stream , the library may buffer more data than the current flow-control window allows. A remote HTTP/2 server can then s...

PT-2026-85660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference exists in the Bluetooth RFCOMM component. The function rfcomm sock recvmsg completes a deferred setup by calling rfcomm dlc accept without holding the rfcomm...

PT-2026-85719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AF PACKET TX RING where socket buffer skb page references preserve page-backed ring blocks after pg vec is freed, but fail to preserve vmalloc mappings. In the...

CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80753 ovpn: run deferred work on a module-owned workqueue

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

EUVD-2026-70357

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80753

CVE-2026-80753 affects the Linux kernel's ovpn module . Work items whose callbacks execute module text ran on the global system workqueues, meaning module exit had no driver-owned drain point to guarantee callbacks had returned before the module text could be freed. Specifically, a worker could d...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

K000163171: Linux kernel netfilter vulnerability CVE-2026-53000

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfreercu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nfhookops that are used to...