CVE-2026-31404 NFSD: Defer sub-object cleanup in export put callbacks

In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svcexportput calls pathput and authdomainput immediately when the last reference drops, before the RCU grace period. RCU readers in eshow and cshow access both expath via...

PT-2026-29721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the handling of asynchronous decryption within the TLS Transport Layer Security protocol. Specifically, the async hold queue, used to manage...

GHSA-38F7-945M-QR2G Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

Versions - effect: 3.19.15 - @effect/rpc: 0.72.1 - @effect/platform: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 App Router - @clerk/nextjs: 6.x Root cause Effect's MixedScheduler batches fiber continuations and drains them inside a single microtask or timer...

Academia and the “AI Brain Drain”

In 2025, Google, Amazon, Microsoft and Meta collectively spent US$380 billion on building artificial-intelligence tools. That number is expected to surge still higher this year, to $650 billion, to fund the building of physical infrastructure, such as data centers see go.nature.com/3lzf79q...

poc-step-finance-2026

Step Finance Stake Authority Compromise — PoC Educational...

SUSE SLES15: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:0774-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0774-1 advisory. This update for python fixes the following issue: - CVE-2024-7592: uncontrolled CPU resource consumption when in http.cookies module...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005742)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005742 advisory. In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in kernfsremove Syzkaller managed to trigger concurrent calls to...

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we...

AZL-77993 CVE-2026-27171 affecting package fltk 1.3.5-4

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...

CVE-2026-27171

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...

CVE-2026-27171

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...

The vulnerability of the drain_obj_stock() function in the mm/memcontrol.c module of the Linux kernel’s memory management subsystem allows a hacker to cause a service failure.

The vulnerability of the drainobjstock function in the mm/memcontrol.c module of the Linux kernel’s memory management subsystem is related to the pointer dereferencing that occurs due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cau...

EUVD-2026-5379

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copyio.Discard, gzi without explicit bounds. With an attacker-controlled input stream, this can force lar...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fixed a race condition related to waking up the NFSLAYOUTDRAIN task. We identified several systems where tasks were stuck in a writeback state, waiting for the same page lock. Additionally, one task was waiting for th...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38282)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38282 advisory. - In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining gua...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000708 advisory. The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service syste...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002621)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002621 advisory. An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an blkdrainqueue use-after-free because a certain error case is mishandled...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003458 advisory. The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service syste...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003368)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003368 advisory. The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service syste...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003537 advisory. An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an blkdrainqueue use-after-free because a certain error case is mishandled...