CVE-2026-72244

A flaw was found in the Linux kernel's gpu/buddy subsystem. The tryharder memory allocation fallback mechanism could return a memory range whose starting offset did not match the required minimum block size. This incorrect memory alignment could lead to improper memory handling within the kernel,...

CVE-2026-72078

A flaw was found in the Linux kernel's ims-pcu driver. This driver incorrectly assumes that the first endpoint of the control interface is an interrupt IN endpoint without proper validation. A malicious Universal Serial Bus USB device could exploit this by providing a different endpoint type. Thi...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

CVE-2026-68466

A flaw was found in the Linux kernel's lpc32xxslc driver, which manages NAND flash memory. This vulnerability occurs because the driver fails to properly handle Direct Memory Access DMA transfer timeouts. When a DMA transfer times out, the driver incorrectly reports it as successful and unmaps th...

CVE-2026-68351

A flaw was found in the carl9170 Wi-Fi driver in the Linux kernel. When the firmware sends a command response with a length mismatch, the carl9170cmdcallback function performs an out-of-bounds read. This occurs because the memcpy operation copies more data than the allocated buffer, potentially...

CVE-2026-68417

A flaw was found in the Linux kernel's RDMA/siw component. The siwcreateqp function prematurely publishes a Queue Pair QP before its complete initialization. This allows a Queue Pair Number QPN lookup to access a QP that is still under construction, potentially leading to unexpected behavior or...

CVE-2026-68229

A flaw was found in the Linux kernel's Cedrus media driver. This vulnerability allows an attacker to cause an out-of-bounds read by providing specially crafted H.264 video streams with invalid reference list entries. This could lead to system instability or potentially information disclosure...

CVE-2026-68350

A flaw was found in the Linux kernel's carl9170 Wi-Fi driver. An out-of-bounds read vulnerability exists within the carl9170txprocessstatus function. This issue is caused by an off-by-two error in a bounds check, allowing the system to read beyond the intended memory buffer when processing...

CVE-2026-68168

A flaw was found in the Linux kernel's Andrew File System AFS component. The system's directory removal function, afseditdirremove, incorrectly manages memory blocks, specifically block 0. This improper handling could lead to an unstable system state or data integrity issues during directory...

CVE-2026-68091

A flaw was found in the Linux kernel's HID Wacom driver. When the wacomparseandregister function encounters failures after starting the Human Interface Device HID hardware, its error handling path releases Wacom resources without properly stopping the HID hardware. This improper resource manageme...

CVE-2026-68181

A flaw was found in the Linux kernel's mei bus component. A use-after-free vulnerability exists in the meiclbusdevrelease function. This flaw, caused by improper synchronization during cleanup, could lead to memory corruption and system instability...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-68419

A flaw was found in the Linux kernel's RDMA/irdma component. A local user could exploit this by attempting to re-register specific memory regions Queue Pair, Completion Queue, or Shared Receive Queue objects that are not intended for re-registration. This could lead to an invalid operation being...

CVE-2026-72604: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-64462

A flaw was found in the Linux kernel's PCI Altera driver. When the driver fails to initialize properly, it can leave interrupt handlers and related resources active with outdated information. This resource leak and stale data pointer can lead to system instability or a denial of service, where th...

gawk: gawk: Memory corruption via integer overflow

A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability...

kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

CVE-2026-64444

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted association response frame. This could lead to an out-of-bounds read vulnerability, potentially causing information disclosure or system...

CVE-2026-64358

A flaw was found in the Linux kernel's media component, specifically within the mtk-jpeg driver. An internal function attempts to cancel a background task even when that task is not active on certain system configurations. This can lead to the system logging warning messages, potentially causing...

CVE-2026-64340

A flaw was found in the Linux kernel's legousbtower USB driver. This vulnerability is a use-after-free, which means the system attempts to use memory after it has been released. It occurs due to a timing issue race condition when a USB device is disconnected, potentially leading to system...