Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a double-release vulnerability, which stems from the bsgdone function resulting in a double-release that can be exploited by an attacker to cause the...

The vulnerability of the mlx5e_ptp_open() function in the drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c driver for Mellanox Ethernet network adapters in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mlx5eptpopen function in the drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c driver for Mellanox Ethernet network adapters in the Linux operating system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failur...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005497)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005497 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ataportalloc call in atahostalloc...

The vulnerability of the do_floppy_init() function in the drivers/block/floppy.c module of the Linux kernel’s block devices driver allows a attacker to cause a service failure.

The vulnerability of the dofloppyinit function in the drivers/block/floppy.c module of the Linux kernel’s block devices driver is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the radeon_acpi_vfct_bios() function in the drivers/gpu/drm/radeon/radeon_bios.c driver of the Direct Rendering Infrastructure (DRI) graphics card for Linux operating systems allows a hacker to cause a system failure.

The vulnerability of the radeonacpivfctbios function in the drivers/gpu/drm/radeon/radeonbios.c driver of the Direct Rendering Infrastructure DRI video card for Linux operating systems is related to improper memory release. Exploiting this vulnerability can allow an attacker to cause a system...

The vulnerability of the `rt2x00libremove_hw()` function in the `drivers/net/wireless/ralink/rt2x00/rt2x00dev.c` file of the Ralink wireless adapter driver in the Linux operating system’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rt2x00libremovehw function in the drivers/net/wireless/ralink/rt2x00/rt2x00dev.c file of the Ralink wireless adapter driver in the Linux operating system kernel is related to improper memory release. Exploiting this vulnerability could allow an attacker to compromise the...

OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

Summary commands.allowFrom is documented as a sender authorization allowlist for commands/directives, but command authorization could include ctx.From conversation identity as a sender candidate. When commands.allowFrom contained conversation-like identifiers for example Discord channel: or...

GHSA-2CH6-X3G4-7759 OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

Summary commands.allowFrom is documented as a sender authorization allowlist for commands/directives, but command authorization could include ctx.From conversation identity as a sender candidate. When commands.allowFrom contained conversation-like identifiers for example Discord channel: or...

GHSA-JXRQ-8FM4-9P58 OpenClaw: Zip extraction symlink traversal could write outside destination

Summary A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root. Affected Packages / Versions - Package: openclaw npm - Latest published npm version at triage time: 2026.2.21-2 - Affecte...

GHSA-62F6-MRCJ-V8H5 OpenClaw's runtime /debug override path accepted prototype-reserved keys

Summary OpenClaw accepted prototype-reserved keys in runtime /debug set override object values proto, constructor, prototype. Impact /debug is disabled by default, and exploitation requires an already authorized /debug set caller. No unauthenticated vector was identified. This issue affects runti...

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

Summary BASHENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.19-2 - Fixed on...

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Summary A trusted-proxy Control UI pairing bypass accepted client.id=control-ui without device identity checks. The bypass did not require operator role, so an authenticated node role session could connect unpaired and reach node event methods. Impact With trusted-proxy authentication enabled, a...

GHSA-4CQV-H74H-93J4 OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry. Affected Packages / Versions - Package: openclaw npm - Affected...

GHSA-FF98-W8HJ-QRXF OpenClaw plugin runtime command execution is part of trusted plugin boundary

Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution runtime.system.runCommandWithTimeout. Impact Plugins already execute with the same OS privileges as the OpenClaw process...

GHSA-P4WH-CR8M-GM6C OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

Summary shell-env fallback trusted prefix-based executable paths for $SHELL, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. Details In affected versions, shell selection accepted either: 1. a shell listed in /etc/shells, or 2. any executable under...

GHSA-V865-P3GQ-HW6M OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

Summary Updated March 2, 2026 Encoded alternate-path requests could bypass plugin route auth checks for /api/channels/ due to canonicalization depth mismatch in vulnerable builds. Affected Packages / Versions - Package: openclaw npm - Latest published vulnerable version: 2026.3.1 - Affected range...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via improper validation of file paths in browser output handling. An attacker can write files outside of intended directory boundaries by...

OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

Impact OpenClaw webhook handlers for BlueBubbles and Google Chat accepted and parsed request bodies before authentication and signature checks on vulnerable releases. This allowed unauthenticated clients to hold parser work open with slow/oversized request bodies and degrade availability...

CVE-2026-1713

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD...

CVE-2026-1713 IBM MQ is affected by an authority vulnerablility

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD...