PT-2026-122155

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The ra...

PT-2026-122431

Summary An allocation-without-limits vulnerability CWE-770 in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with IAC SB and then streams bytes without ever sending the IAC SE...

PT-2026-122413

Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialise...

PT-2026-121890

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon ptep mkold damon va prepare access check picks a random byte address within the region and stores it in r-sampling addr. damon va mkold passes it into a page table walk,...

PT-2026-122006

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5 tc matchall replace allocates a struct sparx5 mall entry for every offloaded matchall filter and adds it to sparx5-mall entries. sparx5 tc matchall destroy removes the entry...

PT-2026-122014

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

PT-2026-121977

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe bo pin external and xe bo unpin external support nested pins, since the underlying ttm bo pin/ttm bo unpin maintain a pin count refcount rather than a...

PT-2026-122000

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of regulator bulk get all of regulator bulk get all allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c...

PT-2026-121948

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm add action or reset invokes the cleanup action immediately when registering the action fails. gpio exar probe currently stores the allocated ID in exar gpio only...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-122213

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate tlb page in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and glob...

PT-2026-121879

In the Linux kernel, the following vulnerability has been resolved: net: cpsw new: unregister devlink on port registration failure cpsw probe registers devlink before registering the CPSW ports. If cpsw register ports fails, the error path only unregisters the notifiers and then releases the lowe...

PT-2026-122442

Summary create entity, link entities, rename entity, unlink entities and delete entity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

PT-2026-122123

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, create entity, link entities, rename entity, unlink entities and delete entity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

ROS-20261023-73-0022

The vulnerability in libssh2 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

PT-2026-121996

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch readconfig looks up the scsi device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt. scsi device...

PT-2026-121934

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs uring read extent fails After btrfs uring read extent, the caller always jumped to out acct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...