Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

...

drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

...

CVE-2026-8917

CVE-2026-8917 — An untrusted pointer dereference via an IOCTL affects ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll . The vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. According to the provided ...

AMD Ryzen™ Master Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2025-54512| A DLL hijacking vulnerability within the AMD Ryzen™ Master installation may allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary co...

PT-2026-70791

A Use‑After‑Free UAF vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability...

CVE-2026-0465: Use After Free

A Use‑After‑Free UAF vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability...

CVE-2026-71968 OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

EUVD-2026-55697

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71968

Technical details beyond the Initial Description are not publicly available in the provided documents. Monitor for updates.

UBUNTU-CVE-2026-68234

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

UBUNTU-CVE-2026-68231

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

UBUNTU-CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

UBUNTU-CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68101

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

EUVD-2026-55614

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...