ROS-20261006-73-0194

The vulnerability of the scorecvframe function in the Linux operating system is related to a violation of the count of links to pages displayed in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

ROS-20261006-73-0122

The vulnerability of the atmelsha204arngreadnonblocking function in the drivers/crypto/atmel-sha204a.c driver of the Linux kernel’s cryptographic accelerator module is related to unlimited resource allocation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20261006-73-0113

The vulnerability of the parseredbootpartitions function in the drivers/mtd/parsers/redboot.c file of the MTD memory driver in the Linux operating system is related to the copying of buffers without checking their size—a classic buffer overflow attack. Exploiting this vulnerability could allow an...

ROS-20261006-73-0097

The vulnerability of the amdgpubocreatelistentryarray function in the drivers/gpu/drm/amd/amdgpu/amdgpubolist.c source file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system leads to unmanageable resource consumption. Exploiting this vulnerability c...

PT-2026-106311

Name of the Vulnerable Software and Affected Versions PickMall Lilishop versions prior to 4.2.5 Description An improper authorization issue exists within the Mobile Binding component. A remote attacker can manipulate the Username argument in an unknown function located in the...

PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

PT-2026-106316

A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in imprope...

Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models

Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recovery. Function-preserving reparameterizations leave information unchanged while altering gradient-descent geometry, so a...

PT-2026-106558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm input function where the current xfrm state is stored in the skb secpath during receive-side processing. Certain input paths, including the VTI receive path,...

PT-2026-106557

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On I6500 CPU cores, the lld and scd instructions do not provide ordering guarantees. This causes an issue where the assumption that the arch cmpxchg function is fully ordered is violated...

PT-2026-106590

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the cifs chan skip or disable function. When a server no longer supports a secondary channel, the function calls cifs put tcp session, which may drop the...

PT-2026-106545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hfi1 file mmap function within the IB/hfi1 driver regarding the PIO CRED credit-return memory mapping. The implementation contains two primary errors: first, it...

PT-2026-106520

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore regdomain config gets a runtime PM reference before sending the regulatory-domain command. When wlcore cmd regdomain config locked fails, the function queues...

PT-2026-106769

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

PT-2026-106605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the network subsystem where sk-sk flags is modified without holding the socket lock. Specifically, the sock gettstamp function calls sock enable timestamp, whi...

PT-2026-106585

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during a non-leader exec call that can lead to a slab-use-after-free UAF situation. This occurs when a SIGEV THREAD ID timer is created against a leader's thread...

PT-2026-106689

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the RDMA/rxe component. The rxe get mcg function publishes a newly allocated multicast group in rxe-mcg tree before the backing Ethernet multicast...

PT-2026-106568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free write occurs in the lan743x driver when a packet spans more than one receive buffer. The function lan743x rx process buffer adds non-first receive buffers to the head...

PT-2026-106636

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11k mac peer cleanup all When mac80211 removes a sta, it calls .sta state which in turn calls ath11k mac station remove. In that function we clean up both peers & arsta related resources. But whe...

PT-2026-106631

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfp ctl set mac address calls ResetAdapter unconditionally, without checking netif running. ResetAdapter first calls card stop, which sets smc-hw.hw state t...