CVE-2026-68287

A flaw was found in the Linux kernel's dropmonitor feature. Incorrect size calculations for 64-bit attributes on 32-bit architectures without efficient unaligned access support can lead to an under-estimation of internal buffer SKB size. This under-estimation may cause a kernel panic, resulting i...

CVE-2026-68167

A flaw was found in the Linux kernel's btrfs filesystem. A local user could trigger a kernel panic by performing specific filesystem operations that involve data relocation. This occurs because the system attempts to compress and inline data for relocation inodes, which are not designed for such...

CVE-2026-68289

A flaw was found in the Linux kernel. An integer overflow vulnerability exists within the Transparent Inter-Process Communication TIPC subsystem, specifically in the tipcrecvmsg and tipcrecvstream functions. This issue occurs when a buffer length value exceeds the maximum integer size, leading to...

CVE-2026-68336

A flaw was found in the Linux kernel's bonding module. When a system is booted with IPv6 disabled, the bonding module incorrectly attempts to send IPv6 Network Service NS packets. This leads to a null pointer dereference, which is an attempt to access uninitialized memory. The consequence of this...

CVE-2026-68179

A flaw was found in the Linux kernel's Network Shared Memory NSM module. A local attacker can exploit an issue in the nsmdevioctl function where an incorrect mutex unlock operation is performed. This occurs when an initial data copy fails, leading to an attempt to unlock a mutex that was never...

RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visit...

RUSTSEC-2026-0252 Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

SplitVec::extendfromslice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of those...

RUSTSEC-2026-0256 Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

Several methods in circular-buffer drop elements before updating the buffer's start/end metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer is later dropped or used after the panic ...

Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

Several methods in sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own...

Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

SplitVec::extendfromslice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of those...

Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

Several methods in circular-buffer drop elements before updating the buffer's start/end metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer is later dropped or used after the panic ...

Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visit...

RUSTSEC-2026-0254 Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

Several methods in sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

CVE-2026-68411

A flaw was found in the Linux kernel's mac80211hwsim component. A malicious backend device could report an oversized receive length to the hwsimvirtiorxwork function. This could cause the system to write past the end of a buffer, leading to a kernel panic and a denial of service DoS for the guest...

drm/amdgpu: Fix kernel panic during driver load failure

...

CVE-2026-19519

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...

drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()

...

drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()

...

CVE-2026-19519

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service...