CVE-2026-90188 null_blk: free global tag_set on init error path

In the Linux kernel, the following vulnerability has been resolved: nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creation later fails, errdev destroys the default devices and calls...

CVE-2026-90188

CVE-2026-90188 affects the Linux kernel 's null_blk block driver. When shared_tags is enabled, null_setup_tagset() allocates a global tag_set via null_init_global_tag_set(). If device creation subsequently fails, the err_dev error path destroys the default devices and calls unregister_blkdev() bu...

EUVD-2026-81721

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90128 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90128 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90125 smb: client: fix request buffer leak in smb2_new_read_req()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

EUVD-2026-81712

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup sndice1712probe performs multiple initialization steps after sndcardnew, but directly returns on failures from later steps without releasing the ALSA card,...

CVE-2026-90119

CVE-2026-90119 affects the Linux kernel 's ALSA ice1712 driver. In snd_ice1712_probe(), multiple initialization steps run after snd_card_new(); if any later step fails, the function returns without releasing the ALSA card, causing a resource leak . The fix replaces snd_card_new() with snd_devm_ca...

CVE-2026-90078 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the error stack formatting process. An attacker can obtain absolute host filesystem paths, including those from Node.js...

GHSA-63M2-QQCH-JXV2 Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6m4-chr9-cg97. This link is maintained to preserve external references. Original Description vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack...

Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6m4-chr9-cg97. This link is maintained to preserve external references. Original Description vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

tomcat: Apache Tomcat: DoS in examples web application

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory OOM error, leading to a denial of service...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...