CVE-2026-80588 mptcp: reclaim forward-allocated memory on RX path errors

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...

CVE-2026-80588

CVE-2026-80588 affects the Linux kernel's MPTCP (Multipath TCP) subsystem . After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing SKBs into the receive queue fail to trigger reclamation of forward-allocated memory. In pathological dr...

CVE-2026-80571

CVE-2026-80571 affects the Linux kernel on powerpc/pseries systems, specifically the papr-phy-attest driver. In the function papr_phy_attest_create_handle() , the field params->cmd.length is not validated before use, which can result in a buffer overflow . The driver also fails to free params ...

CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80555

CVE-2026-80555 affects the Linux kernel on s390 architecture, specifically the vfio_ccw subsystem. The root cause is a memory leak that occurs when cp_init() fails: the existing cleanup in ccwchain_handle_ccw() only frees the currently-processed CCW segment, leaking other segments allocated as pa...

CVE-2026-80555 s390/vfio_ccw: Free all memory if cp_init() fails

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80555 s390/vfio_ccw: Free all memory if cp_init() fails

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80539

CVE-2026-80539 affects the Linux kernel 's drm/amdgpu driver. In amdgpu_cs_pass1(), a user submission carrying multiple AMDGPU_CHUNK_ID_FENCE chunks causes amdgpu_cs_p1_user_fence() to run more than once. Because p->uf_bo is a single-slot field, each subsequent call overwrites it with a newly ...

CVE-2026-80534

CVE-2026-80534 is a lock-leak bug in the XFS filesystem of the Linux kernel. The function xfs_dq_get_next_id() acquires the quota inode ILock before calling xfs_iread_extents() ; if that call fails, the function returns early without releasing the lock, leaving the quota inode permanently locked....

CVE-2026-80534 xfs: fix ilock leak on error in xfs_dq_get_next_id

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...

CVE-2026-80534 xfs: fix ilock leak on error in xfs_dq_get_next_id

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...

CVE-2026-74735 l2tp: fix tunnel and session refcount leak on seq_file release

In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seqfile release In pppol2tpprocopen and l2tpdfsseqopen, iteration state pd-tunnel and pd-session is kept in seqfile private data to allow iteration across multiple read system calls...

CVE-2026-74735

CVE-2026-74735 affects the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is stored in seq_file private data to support multi-read() iteration. If a local user closes /proc/net/pp...

EUVD-2026-41136

Wasmtime has a leak in WASIp1 fdrenumber implementation...

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

CVE-2026-78895

A flaw was found in Chromium. A remote attacker could exploit an information leak in the Paint component by crafting a malicious HTML page. This vulnerability allows the attacker to bypass the web origin policy, potentially leading to unauthorized access to sensitive information...

nwn-exploit

Exploit Neverwinter Nights: Enhanced Edition Questa repository contiene una PoC per sfruttare Neverwinter Nights: Enhanced Editions. Questo articolo del blog descrive le vulnerabilità e lo sfruttamento. Versione di Windows: 10.0.19045.2965 Neverwinter Night Enhanced Editions: versione vulnerabile...

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2026-23204: net: add skbheaderpointercareful helper bsc1258340. CVE-2026-52986: netfilter:...