CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64398 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64265 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intrentry in fuseresend and fuseremovependingreq When fuseresend moves a request from fpq-processing back to fiq-pending, it sets FRPENDING and clears FRSENT but does not remove the requests intrentry from...

CVE-2026-64265

The CVE-2026-64265 issue affects the Linux kernel fuse subsystem. When fuse_resend() moves a request from fpq->processing back to fiq->pending, it marks FR_PENDING and clears FR_SENT but fails to remove the request’s intr_entry from fiq->interrupts. If FR_INTERRUPTED was set previously, ...

Linux Distros Unpatched Vulnerability : CVE-2026-64423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast li...

PT-2026-64680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where the RCU Read-Copy-Update grace period was incorrectly removed from the tcp ao destroy sock function. This occurs specifically during the t...

PT-2026-64486

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the FUSE Filesystem in Userspace module. When the fuse resend function moves a request from fpq-processing back to fiq-pending, it fails to remove the in...

Budibase: SQL Injection via `multipleStatements: true`

Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...

CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

A Sneaky Hacking Tool Targeting AI Infrastructure Is Lurking in Victims’ Blind Spots

A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users...

CVE-2026-63812

A flaw was found in the Linux kernel's f2fs Flash-Friendly File System. Incorrect handling of extent information during inode destruction can lead to a stale extent cache. This can result in data integrity issues or filesystem corruption, potentially requiring administrative intervention to repai...

Linux Distros Unpatched Vulnerability : CVE-2026-63976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP...

Linux Distros Unpatched Vulnerability : CVE-2026-64044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls...

CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64105 KVM: arm64: vgic: Free private_irqs when init fails after allocation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-53378

In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the...

CVE-2026-53378

In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the...

CVE-2026-53378

In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the...