PT-2026-64636

In the Linux kernel, the following vulnerability has been resolved: mm/swap: add cond resched in swap reclaim full clusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about...

PT-2026-64547

In the Linux kernel, the following vulnerability has been resolved: block: skip sync blockdev on surprise removal in bdev mark dead bdev mark dead's @surprise == true means the device is already gone. The filesystem callback fs bdev mark dead honours this and skips sync filesystem, but the bare...

PT-2026-64674

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio disconnect walks usbio-cli list in reverse and uninitializes each auxiliary device. auxiliary device uninit drops the device reference, and for an unbound child that c...

PT-2026-64689

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder free transaction In binder free transaction, the t-to proc is read under the t-lock. However, once the t-lock is dropped, the to proc can die in parallel. This leads to a use-after-free error when we...

PT-2026-64677

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy data random recv done stores the device-reported used.len directly into vi-data avail. copy data then indexes vi-data using vi-data idx advanced by previous copy data calls an...

PT-2026-64642

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in media entity remove link during rmmod of imx8 isi: BUG: KASAN: slab-use-after-free in media entity remove link+0x608/0x650 Read of size 2 a...

PT-2026-64645

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in raw spin lock irqsave+0x3b/0x80 Read of size 1 at addr ... by task...

PT-2026-64652

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post write mst fixup for invalid index block ntfs icx ib sync write calls post write mst fixup when ntfs ib write returns an error, intending to restore the buffer after a failed write. However, ntfs ib write...

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Summary hubuumclient diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. Affected behavior Native reqwest::Error values retain the full request URL. Converting those errors into...

EUVD-2026-42639

Open WebUI: Arena task endpoints can bypass underlying model access controls...

Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Summary A malicious SSH server can crash a russh client session with a single malformed key-exchange reply, causing a pre-authentication Denial-of-Service before the server host key is verified. The embedding process itself stays up, but the connection is killed deterministically. Details Every...

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

CVE-2026-64247

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank the TLFS allows for a maximum o...

CVE-2026-64252

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the initial console output handler from a kernel thread other than the initial one will result in a situation where the stack has...

CVE-2026-64229

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X86FEATUREPCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled. There are...

CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...