CVE-2026-16419

A flaw was found in Google Chrome's ANGLE component on Android. A remote attacker could exploit an out-of-bounds memory access vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to escape the browser's security sandbox, leading to...

PT-2026-65471

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

Updated nginx packages fix security vulnerabilities

CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string...

EUVD-2026-49541

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able to cause unexpected system termination or read kernel memory...

CVE-2026-64477

A flaw was found in the Linux kernel. When a CPU is taken offline on systems with Sub-NUMA Clustering SNC enabled, a programming error in the resource control resctrl file system can lead to an out-of-bounds memory access. This issue may cause system instability or crashes. The vulnerability aris...

CVE-2026-64431

A flaw was found in the Linux kernel's NTFS file system driver. A remote attacker could exploit this vulnerability by providing a specially crafted NTFS image, leading to out-of-bounds memory access. This memory corruption can cause the system to crash, resulting in a denial of service...

CVE-2026-64261

A flaw was found in the Linux kernel's fuse-uring component. This use-after-free vulnerability allows a local attacker to potentially achieve privilege escalation. The issue arises when the fuseuringasyncstopqueues function attempts to access memory that has already been freed, leading to...

CVE-2026-64485

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA compress module. The sndcomprtasknew function, responsible for creating driver tasks, does not properly handle errors during the validation of Direct Memory Access DMA buffers or file descriptor reservation. This...

CVE-2026-51298

...

ROS-20260727-73-0027

A vulnerability in the Apache HTTP Server's OCSP protocol implementation is related to out-of-bounds memory access. Exploitation of this vulnerability could allow a remote attacker to cause a denial of service...

EUVD-2026-49353

sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still accesses internal member of the freed pointer, which can cause service crash and denial of service...

CVE-2026-51304

...

UBUNTU-CVE-2026-64234

In the Linux kernel, the following vulnerability has been resolved: tty: serial: pchuart: add check for dmaalloccoherent Add a check for dmaalloccoherent failure to prevent a potential NULL pointer dereference in dmahandlerx. Properly release DMA channels and the PCI device reference using a goto...

UBUNTU-CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

UBUNTU-CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

EUVD-2026-48915

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64337

CVE-2026-64337 (Linux kernel): usb mtu3 flaw where mtu3_gadget_queue() maps the request before verifying QMU GPD space, causing a DMA mapping to remain active if mtu3_prepare_transfer() fails and the request isn’t linked. The fix unmaps the DMA on the failed queue path before returning. Documents...

EUVD-2026-48881

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix DMA fence leak In ffsdmabuftransfer, a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit, which sets its kref counter to 1. Then, dmaresvaddfence gets a second...