29805 matches found
CVE-2026-74514
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...
CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...
CVE-2026-74536
In CVE-2026-74536, the Linux kernel Bluetooth ISO stack suffers a leak: iso_sock_kill() can leak the sk reference after socket release or when __iso_sock_close() does not set SOCK_ZAPPED, because sock_orphan(sk) marks SOCK_DEAD. The fix replaces SOCK_DEAD with a dedicated BT_SK_KILLED flag and ad...
CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...
CVE-2026-74531 Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74531
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74531 Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
EUVD-2026-59722
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74529
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...
CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...
CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...
EUVD-2026-59707
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...
CVE-2026-74514
Summary of CVE-2026-74514 (Linux kernel, KVM on s390): The issue arises in memory accounting for pinned/unpinned pages where account_mem() and unaccount_mem() call get_uid() multiple times without corresponding free_uid() calls, potentially leaving a reference on the wrong process context. The bu...
EUVD-2026-59686
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...
CVE-2026-16142 TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...
MINI-7944-3VH8-7CG2
Bulletin has no description...