CVE-2026-28835

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Mounting a maliciously crafted SMB network share may lead to system termination...

Security Bulletin: IBM Technical Support Appliance - potential denial of service in Linux kernel subsystems

Summary Multiple vulnerabilities have been identified in the Linux kernel affecting subsystems including RDMA rxe and core memory management. These issues involve conditions such as double free, incomplete state handling, and NULL pointer dereference, which could lead to system instability or...

x86/efi: defer freeing of boot services memory

...

The vulnerability of the filemap_get_read_batch() function in the mm/filemap.c module of the Linux kernel’s memory management subsystem allows a hacker to cause a service failure.

The vulnerability of the filemapgetreadbatch function in the mm/filemap.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the page_cache_ra_order() function in the mm/readahead.c module of the Linux kernel’s memory management subsystem allows a hacker to induce a service failure.

The vulnerability of the pagecacheraorder function in the mm/readahead.c module of the Linux kernel’s memory management subsystem is related to incorrect type conversion or casting. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the swap_readpage() function in the mm/page_io.c module of the Linux kernel’s memory management subsystem allows a hacker to cause a service failure.

The vulnerability of the swapreadpage function in the mm/pageio.c module of the Linux kernel’s memory management subsystem is related to uncontrolled memory allocation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `tcp_bpf_send_verdict()` function in the `net/ipv4/tcp_bpf.c` module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcpbpfsendverdict function in the net/ipv4/tcpbpf.c module of the Linux kernel is related to the repeated release and reuse of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

The vulnerability of the reset_page() function in the mm/zsmalloc.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a service failure.

The vulnerability of the resetpage function in the mm/zsmalloc.c module of the Linux kernel’s memory management subsystem is related to the swapping of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-20004

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this...

CVE-2026-23326

A flaw was found in the Linux kernel. An issue in the eXpress Data Path XDP socket xsk component, specifically during fragment node deletion, can lead to a buffer leak. This occurs because a list node is not properly reinitialized after removal, causing the system to incorrectly manage memory. Th...

kernel: Linux kernel: Use-after-free vulnerability in page_pool_recycle_in_ring can lead to arbitrary code execution

A flaw was found in the Linux kernel. This vulnerability, known as a use-after-free UAF, occurs in the pagepoolrecycleinring function. A local attacker could exploit this by manipulating the system's memory management, causing a freed memory region to be improperly accessed. This can lead to syst...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple has fixed several vulnerabilities in iOS and iPadOS. The vulnerabilities include several issues such as improper path management, memory management, and insufficient input validation, which could lead to unauthorized access to sensitive data, unexpected application terminations, and other...

CVE-2026-23380

A flaw was found in the Linux kernel. A local user could exploit an issue in the tracing buffer's memory management when a process forks. If an application uses madviseMADVISEDOFORK, it can cause the tracingbuffersmmapclose function to be called multiple times, leading to a system warning and...

CVE-2026-23352

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efifreebootservices frees memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issue with that: memblockfreelate should be used for...

CVE-2026-23389

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in icesetringparam In icesetringparam, txrings and xdprings are allocated before rxrings. If the allocation of rxrings fails, the code jumps to the done label leaking both txrings and xdprings. Furthermore, i...

CVE-2026-23375 mm: thp: deny THP for files on anonymous inodes

In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes filethpenabled incorrectly allows THP for files on anonymous inodes e.g. guestmemfd and secretmem. These files are created via allocfilepseudo, which does not call getwriteaccess an...

CVE-2026-23375

In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes filethpenabled incorrectly allows THP for files on anonymous inodes e.g. guestmemfd and secretmem. These files are created via allocfilepseudo, which does not call getwriteaccess an...

CVE-2026-23352 x86/efi: defer freeing of boot services memory

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efifreebootservices frees memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issue with that: memblockfreelate should be used for...

CVE-2026-23339 nfc: nci: free skb on nci_transceive early error paths

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on ncitransceive early error paths ncitransceive takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCIDATAEXCHAN...

SUSE-SU-2026:20873-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues. The following security issues were fixed: - CVE-2025-39753: gfs2: Set .migratefolio in gfs2rgrp,metaaops bsc1249590. - CVE-2025-39964: crypto: afalg - Disallow concurrent writes in afalgsendmsg bsc1251966. -...