CVE-2026-72086

A flaw was found in the Linux kernel's scsi: xen: scsiback component. A pvSCSI guest can trigger a resource leak by issuing specific SCSI Small Computer System Interface requests when a task management operation fails. This vulnerability allows the guest to leak command tags associated with a...

CVE-2026-72085

A flaw was found in the Linux kernel's scsi: xen: scsiback component. This vulnerability allows a malicious virtualized SCSI pvSCSI guest to trigger a reference count underflow by sending specially crafted requests. This can lead to a denial of service, potentially stopping a Logical Unit Number...

CVE-2026-72082

A flaw was found in the Linux kernel's SCSI Small Computer System Interface elx: efct module. This vulnerability occurs when an I/O abort operation fails to properly release a resource reference. This can lead to a permanent resource leak, which prevents subsequent attempts to abort the same I/O...

CVE-2026-72081

A flaw was found in the Linux kernel's scsi: elx: efct driver. When processing an unsolicited Fibre Channel Protocol FCP command that contains an unsupported additional Command Descriptor Block CDB, the system fails to properly free allocated I/O resources. This resource leak can lead to resource...

CVE-2026-72080

A flaw was found in the Linux kernel's resctrl filesystem. During the unmount process, a timing issue can occur where a concurrent reader of an event file attempts to access memory that has already been released. This 'use-after-free' vulnerability allows a local attacker to dereference invalid...

CVE-2026-72079

A flaw was found in the Linux kernel's ims-pcu driver. A malicious device can exploit an issue in the imspcudisconnect function, which incorrectly distinguishes between control and data interfaces. By presenting a data interface with the same class as the control interface, a malicious device can...

CVE-2026-72078

A flaw was found in the Linux kernel's ims-pcu driver. This driver incorrectly assumes that the first endpoint of the control interface is an interrupt IN endpoint without proper validation. A malicious Universal Serial Bus USB device could exploit this by providing a different endpoint type. Thi...

CVE-2026-72077

A flaw was found in the Linux kernel's ims-pcu input driver. This vulnerability occurs when the firmware object is not properly released if validation fails during an asynchronous update. This oversight can lead to a firmware leak, potentially exposing sensitive information or system resources. T...

CVE-2026-72076

A flaw was found in the Linux kernel's ims-pcu driver. The debug logging in the imspcuirq function can attempt to read data beyond the allocated buffer when processing certain Universal Serial Bus USB control requests. This out-of-bounds read occurs if the length of the control request exceeds th...

CVE-2026-72075

A flaw was found in the Linux kernel's ims-pcu input driver. A race condition occurs when the imspcuresetdevice function is called without proper synchronization, allowing concurrent operations to corrupt a shared command buffer. This vulnerability could be exploited by a local attacker to cause...

CVE-2026-72074

A flaw was found in the Linux kernel's ims-pcu driver. A type confusion vulnerability exists in the CDC union descriptor parsing, where the driver trusts the bMasterInterface0 value without proper verification. This could allow a local attacker, or a malicious USB device, to overwrite the private...

CVE-2026-64760

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state...

CVE-2026-64760

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state...

CVE-2026-64760

CVE-2026-64760 is an information leakage vulnerability in iOS and iPadOS where a malicious app may be able to leak sensitive kernel state . The issue was addressed with additional validation , indicating insufficient input validation as the underlying cause. It is fixed in iOS 18.7.10 and iPadOS ...

CVE-2026-65330

CVE-2026-65330 is a kernel memory-handling flaw in Apple devices; any installed app may trigger system crashes or corrupt kernel memory. Fixed in iOS/iPadOS 26.6.1 and macOS Tahoe 26.6.2. No active exploitation reported. CISA SSVC rates partial technical impact, non-automatable. Update to the pat...

CVE-2026-65330

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or corrupt kernel memory...

CVE-2026-65330

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or corrupt kernel memory...

CVE-2026-65349

An out-of-bounds read in Apple's Kernel component allows a local app to crash the system or read kernel memory. Fixed in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. CVSS 6.6 (Medium). No in-the-wild exploitation reported. Affected devices: iPhone 11+, iPad Pro 3rd gen+, iPad Air 3rd gen+, ...

CVE-2026-65349

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...

CVE-2026-65349

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...