CVE-2026-52976

The CVE-2026-52976 issue affects the Linux kernel drm/xe driver. Two error-handling paths in xe_exec_queue_create_ioctl() can lead to memory corruption: (1) on xe_hw_engine_group_add_exec_queue() failure, the cleanup jumps to cleanup without xe_exec_queue_kill(), potentially leaving a queue in th...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Added bpfprogrundatapointers syzbot found that clsbpfclassify can change tcskbcbskb-dropreason, triggering a warning in skskbreasonDrop. WARNING: CPU: 0, PID: 5965, at net/core/skbuff.c:1192 skskbreasonDrop,...

CVE-2026-52924 sctp: purge outqueue on stale COOKIE-ECHO handling

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctpstreamupdate is only invoked when the association is moved into COOKIEWAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state...

CVE-2026-52923

The CVE-2026-52923 issue affects the Linux kernel IPC ID allocation in the checkpoint/restore path. ipc_idr_alloc() forwards the next_id request to idr_alloc() with an open-ended upper bound, so if the valid SysV IPC id tail is full the allocation can spill past ipc_mni. The encoded id may then r...

libxslt: use-after-free with key data stored cross-RVT

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash...

kernel: macvlan: fix possible UAF in macvlan_forward_source()

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlanforwardsource Add RCU protection on struct macvlansourceentry-vlan. Whenever macvlanhashdelsource is called, we must clear entry-vlan pointer before RCU grace period starts. This allows...

rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding

A flaw was found in rsync. An authenticated daemon peer can exploit an integer overflow vulnerability in the compressed-token decoder. By carefully manipulating the compressed-token, a malicious sender can trigger an overflow, leading to remote memory disclosure. This allows an attacker to leak...

The vulnerability of Microsoft Word, Microsoft Office products, Microsoft 365 Apps for Enterprise, SharePoint Enterprise Server, and SharePoint Server relates to the manipulation of pointers, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to the use of an untrusted pointer. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

Obliv-Clang: Real-World Oblivious Programming in C++

Side-channel vulnerabilities, particularly timing and access-pattern-based attacks, have become critical issues for confidential data processing in trusted environments. Oblivious programming is an effective approach to alleviate these attacks by making program execution not leak any secret throu...

CVE-2026-45329

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in espsecureservices.c and espsecureservicesiram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked...

CVE-2026-45329

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in espsecureservices.c and espsecureservicesiram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked...

PT-2026-48351

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.5.4 ESF-IDF version 6.0 Description Several ESP-TEE secure-service wrappers in esp secure services.c and esp secure services iram.c fail to validate all caller-supplied pointer arguments. Since the TEE-protected hardware...

CVE-2026-46325 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE The current implementation incorrectly handles memory regions MRs with page sizes different from the system PAGESIZE. The core issue is that rxesetpage is called...

cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections...

DFVULN-839 - Use-After-Free in MessagePack::Buffer#clear Enables Cross-Buffer Disclosure

Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmemlast, rmemend, rmemowner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...

Adobe Dreamweaver Desktop 缓冲区错误漏洞

Adobe Dreamweaver Desktop is a web design and development software provided by Adobe, a company based in America. Versions of Adobe Dreamweaver Desktop starting from 21.7 and earlier contain a buffer error vulnerability. This vulnerability stems from accessing uninitialized pointers, which may...

CVE-2026-46274

CVE-2026-46274 (Linux kernel, io_wq) has concrete details: a bug in io_wq_remove_pending() allowed a non-hashed predecessor to be treated as hashed, causing a stale pointer in wq->hash_tail[] to persist and be dereferenced by future hashed bucket-0 enqueues. The root cause is that io_get_work_...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the unreferenced empty pointers in the s3c64xx SPI driver, potentially leading to system crashes...

The vulnerability of the `net.Dial()` and `net.LookupPort()` functions in the Go programming language for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the net.Dial and net.LookupPort functions in the Go programming language for Windows operating systems is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause service interruptions...

CVE-2026-45683

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpfproberead instead of bpfprobereaduser. An instrumented local process can therefore point OBI at kerne...