CVE-2026-30963

Capsule (a Kubernetes multi-tenancy framework) relied on a webhook to validate namespace updates, but prior to v0.13.0 it did not intercept namespace/status or namespace/finalize subresource changes. This omission enables a tenant with permission to modify those subresources to hijack other names...

CVE-2026-30963: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...

Capsule Namespace Hijacking via subresource

Summary To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a...

GHSA-2WW6-HF35-MFJM Capsule Namespace Hijacking via subresource

Summary To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a...

PT-2026-44722

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.0 Description Capsule uses a webhook to validate update requests targeting namespaces to prevent namespace hijacking. However, the webhook fails to define interception rules for the 'namespace/finalize' and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handling the kvmarminit failure in finalizepkvm Currently, there is no synchronization between the finalizepkvm and kvmarminit initcalls. The finalizepkvm continues to execute even if kvmarminit fails,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 – Fixed the issue of using resources after freeing them. The preprepare call must be executed before the finalize call; otherwise, finalize may free the resources that were previously allocated...

The vulnerability of the finalize_pkvm() function in Linux operating systems allows a hacker to trigger a service failure.

The vulnerability of the finalizepkvm function in Linux operating systems is related to improper release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-51881

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free flaw exists in the drm/amdgpu component within the userq validate function. The issue occurs when amdgpu userq vm validate calls the drm exec fini function on an execution...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010804)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010804 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipcmonreinitself. syzbot reported use-after-free of...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-007032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007032 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx - call finalize with bh disabled When calling cryptofinalizerequest, BH should be...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-006896)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006896 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx - call finalize with bh disabled When calling cryptofinalizerequest, BH should be...

PT-2026-32370

Name of the Vulnerable Software and Affected Versions FFmpeg version 8.0.1 Description A heap buffer overflow in the av bprint finalize function allows attackers to cause a Denial of Service DoS via a crafted input. A heap buffer overflow occurs when a program writes more data to a heap-allocated...

openjph:ojph_expand_fuzz_target: Use-of-uninitialized-value in ojph::local::tile::finalize_alloc

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5205194525966336 Project: openjph Fuzzing Engine: libFuzzer Fuzz Target: ojphexpandfuzztarget Job Type: libfuzzermsanopenjph Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

The vulnerability of the migrate_device_finalize() function in the mm/migrate_device.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a service failure.

The vulnerability of the migratedevicefinalize function in the mm/migratedevice.c file of the Linux kernel’s memory management subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2024-35792)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-35792 advisory. - In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - Fix use after...

EUVD-2026-2936

Deno node:crypto doesn't finalize cipher...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003605)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003605 advisory. In the Linux kernel before 5.0.3, a memory leak exits in hsrdevfinalize in net/hsr/hsrdevice.c if hsraddport fails to add a port, which may cause denial of service,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: don't add folio to be freed to LRU in migratedevicefinalize If migration succeeded, we called foliomigrateflags-memcgroupmigrate to migrate the memcg from the old to the new folio. This will set memcgdata of the...

SUSE CVE-2023-54156

In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efxnetstats .ndogetstats64 can be called during an ethtool selftest, during which time nicdata-mcstats is NULL as the NIC has been fini'd. In this case do not attempt to...