Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

CVE-2026-104855

A flaw was found in wasmtime. Execution preemption checks during bulk operations can expose an invalid intermediate state if an application mutates or continues using the execution store after a cancellation or trap. Under these conditions, an attacker executing WebAssembly code can cause memory...

EUVD-2026-91765

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

hardstop

Hard Stop：面向失控智能体执行的核级抢占与遏制 关于 Nvidia 开放智能体安全平台（2026 年 9 月 28 日）的说明： Nvidia 新宣布的 Sentry 架构利用带外 BlueField DPU 实现毫秒级智能体遏制。 Hard Stop 提供了一种软件定义的替代方案。通过利用内联 eBPF LSM 钩子和 cgroup v2，该参考实现完全以软件方式在通用 Linux 硬件上实现了低于 5 微秒 的抢占，无需专用芯片即可提供真正的零泄漏遏制。 摘要： 一个在连续执行循环中运行、且没有带外认知安灯拉绳 的自主生成式 AI，是一种存在性运营危害。 Hard Stop...

Linux Distros Unpatched Vulnerability : CVE-2026-93254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to...

CVE-2026-93254

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

DEBIAN-CVE-2026-93254

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

CVE-2026-93254 arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

EUVD-2026-86126

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

PT-2026-97941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 entry code where local irq disable is called unnecessarily when exiting to kernel mode. This occurs because the preemption logic expects interrupts to be...

CVE-2026-90212

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

SUSE CVE-2026-89799

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...

CVE-2026-90212 arm64/efi: Avoid voluntary preemption with efi_mm installed

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-90212 arm64/efi: Avoid voluntary preemption with efi_mm installed

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

EUVD-2026-81805

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-90212: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-89799

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...

AZL-101343 CVE-2026-89799 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...

DEBIAN-CVE-2026-89799

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...

CVE-2026-89799 bpf: Disable preemption in bpf_get_stackid

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpfgetstackidpe function is executed already...