PT-2026-94752

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cros ec debugfs probe function where the notifier panic is registered with the EC panic notifier chain, but the remove path fails to unregister it before tearing...

PT-2026-94808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ext4 file system when handling inline data writes. A concurrent thread, such as ext4 page mkwrite, can convert inline data to an extent between the write...

PT-2026-94445

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the VMBus module where the initialization function hv acpi init does nothing when running in a non-nested root partition but still reports success, leading the module ...

PT-2026-94577

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the admin queue, allocated via blk mq alloc queue, is not properly destroyed during removal. When the controller fails to initialize and is...

PT-2026-94931

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier skips rewriting the helper call offset insn-imm in bpf do misc fixups for architectures that implement bpf...

CVE-2026-92500: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...

CVE-2026-90382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-90192: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90129: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virtioballoon: quiesce balloon work before device shutdown Commit 8bd2fa086a04 "virtio: break and reset virtio devices on deviceshutdown" added a generic virtio bus .shutdown handler that breaks and resets every virtio device...

PT-2026-94617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to rewrite BPF LOAD ACQ instructions to BPF PROBE MEM loads, unlike the behavior for regular BPF LDX...

PT-2026-94651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the show pte function when CONFIG DEBUG USER=y and the user debug=31 command line option is enabled. This occurs because a user fault can trigger show pt...

PT-2026-94730

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt76x02 component of the wifi driver where the kernel may trigger a warning when encountering an invalid rx descriptor length. In monitor mode with the fcsfail...

PT-2026-94982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL mailbox implementation where the out.size parameter is not bounded. When CXL MEM SEND COMMAND is used, the cxl mbox cmd ctor function calls kvzallocout.size...

CVE-2026-93186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-92790

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

EUVD-2026-81053

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

GO-2026-6452 Panic via negative shared-string index in github.com/xuri/excelize

In github.com/xuri/excelize/v2, parsing a spreadsheet cell with a negative shared-string index causes a runtime panic. The shared-string lookup in xlsxC.getValueFrom checks only the upper bound of the parsed index against the shared-string slice length, causing negative indices such as -1 to bypa...