CVE-2026-64377

A double free vulnerability exists in the Linux kernel's qcom-cpufreq-hw driver (Qualcomm CPU frequency hardware). The root cause is that qcom_cpufreq_hw_cpu_exit() calls kfree() on policy->driver_data, which points to memory allocated via devm_kzalloc() in probe(). For the first domain, this ...

CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64377

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64359

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

EUVD-2026-48903

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64359

CVE-2026-64359 affects the nilfs2 filesystem in the Linux kernel. User-supplied segment numbers passed via NILFS_IOCTL_CLEAN_SEGMENTS were not validated before processing began; out-of-range values reached deep in the call chain where per-entry warnings were emitted while still holding the ns_seg...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64272

Summary of CVE-2026-64272 : A bug in the Linux kernel MMS114 touch screen driver misreads touch data because it assumed 8-byte events, while MMS134S/MMS136 report 6-byte events. The driver loops over events using an 8-byte step (sizeof(struct mms114_touch)) but the actual packet size is 6 bytes p...

CVE-2026-64272

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

EUVD-2026-48984

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

JLSEC-2026-796 XSS via unescaped code-fence language in default code block renderer

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out...

JLSEC-2026-791 Writing to SFTP files resulting in sending out-of-bounds data to the server

Impact The write::SftpFile, ::DenseVector method assumed that the element type of the input vector had a size of 1 byte e.g. Int8/UInt8, and used lengthdata instead of sizeofdata to get the number of bytes to send. If the input vector had a eltype with size more than 1 byte then this would result...

sbomlyze v0.3.5

sbomlyze git diff for your SBOM. Compare two Software Bills of Materials and see what changed between builds, versions, and releases. sbomlyze compares component hashes, not only version strings. When an attacker swaps a package without bumping its version, sbomlyze flags it. Generators and...

mcpsnoop v0.14.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

SUSE CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

PT-2026-64634

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ebtables table translation where a sparse cpu possible mask can lead to an uninitialized pointer free. If the cpu possible mask is sparse, the allocation...

PT-2026-64662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Three Information Element IE and attribute parsing functions in the rtl8723bs staging driver contain missing bounds checks, leading to out-of-bounds reads. The functions rtw get sec ie a...