Beyond End-To-End Success: Diagnosing Failures in Long-Horizon Security LLM Agents

Long-horizon security LLM agents must carry information and decisions across many dependent interactions, where later actions often depend on services, state, or access discovered much earlier. This makes final task success difficult to interpret: an agent may fail before it ever reaches the poin...

CVE-2026-12634

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-12634

In Zephyr's settings NVS backend (subsys/settings/src/settings_nvs.c), three functions (settings_nvs_cache_match, settings_nvs_load, settings_nvs_save) use the nvs_read() return value directly as a NUL-terminator index into 74-byte stack buffers without clamping, causing a single-byte out-of-boun...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-72155

A flaw was found in the Linux kernel's mtd: spi-nor: swp component. When a user attempts to unlock specific blocks on a Serial Peripheral Interface SPI NOR flash device, particularly those at the beginning of the device, the operation may fail. This occurs due to an incorrect calculation of the...

PT-2026-78686

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settings nvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '0', where rc is the return value of nvs read. Per its contract, nvs read returns the full stored entry lengt...

CVE-2026-72168

A flaw was found in the Linux kernel's Memory Technology Device MTD subsystem, specifically within the vmu-flash driver. This vulnerability arises from incorrect memory allocation, where kmallocobj was used instead of kzallocobj for memcard structures. This can lead to access of uninitialized dat...

CVE-2026-68467

A flaw was found in the Linux kernel's mtd: mchp23k256 driver. This driver, responsible for managing memory technology devices MTD, incorrectly determined the capabilities of certain SPI Serial Peripheral Interface flash chips. This could lead to the system misinterpreting the memory device's...

CVE-2026-68466

A flaw was found in the Linux kernel's lpc32xxslc driver, which manages NAND flash memory. This vulnerability occurs because the driver fails to properly handle Direct Memory Access DMA transfer timeouts. When a DMA transfer times out, the driver incorrectly reports it as successful and unmaps th...

CVE-2026-9771: Untrusted Pointer Dereference

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

UBUNTU-CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

CVE-2026-72168

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

CVE-2026-72155

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

CVE-2026-72168

In the Linux kernel vulnerability CVE-2026-72168, the issue lies in the mtd: maps: vmu-flash path where memcard structs could access uninitialized data due to the use of kmalloc_obj()/kmalloc_objs(). The fix changes memory allocation to kzalloc_obj()/kzalloc_objs(), mitigating the fault seen duri...

CVE-2026-72168 mtd: maps: vmu-flash: fix fault in unaligned fixup

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

CVE-2026-72168 mtd: maps: vmu-flash: fix fault in unaligned fixup

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

EUVD-2026-58926

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzallocobj / kzallocobjs to allocate the memcard structs, instead of kmallocobj / kmallocobjs to prevent access to uninitialized data. Fixes runtime error: Fault in unaligned...

PT-2026-72356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmu-flash maps of the mtd module where the use of kmalloc obj and kmalloc objs to allocate memcard structs allows access to uninitialized data. This leads to a...