CVE-2026-68188 Bluetooth: RFCOMM: Fix session UAF in set_termios

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

EUVD-2026-55289

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

CVE-2026-68188

CVE-2026-68188 : In the Linux kernel Bluetooth RFCOMM path, a race caused use-after-free in rfcomm_send_rpn when rfcomm_tty_set_termios tests dlc->session without holding rfcomm_mutex and the DLC/session is freed by krfcommd. The fix adds rfcomm_dlc_send_rpn() that holds rfcomm_mutex while ver...

EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

EUVD-2026-55551

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68165

The CVE affects the Linux kernel DAMON subsystem (mm/damon/core) where damon_set_regions() did not validate zero-length regions created by certain callers (DAMON_SYSFS, DAMON_RECLAIM, DAMON_LRU_SORT). This could trigger WARN_ONCE on CONFIG_DAMON_DEBUG_SANITY and cause a divide-by-zero in damon_me...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68164

The CVE concerns the Linux kernel DAMON subsystem, specifically the function damon_set_regions() in mm/damon/core. The root cause was that input ranges were assumed to be sorted and non-overlapping, but a prior commit removed validation, allowing overlapping ranges. The consequence can be odd mon...

EUVD-2026-55550

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

EUVD-2026-55529

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145

CVE-2026-68145 describes a Linux kernel iomap vulnerability where zero-length ranges in ifs_set_range_dirty() and ifs_set_range_uptodate() cause an unsigned underflow in (off + len - 1) >> i_blkbits, producing a huge last_blk and nr_blks and leading to out-of-bounds bitmap_set() writes. A f...

CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

EUVD-2026-55481

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

CVE-2026-19384

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

PT-2026-69549

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtual file system VFS helper forget cached acl where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesyste...

PT-2026-69704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the brcmfmac WiFi driver where a call trace warning occurs when the wpa auth is in 1x 256 mode. This happens because the use fwsup variable is not correctly set to BRC...

PT-2026-69738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the net/packet component during the execution of the packet set ring function. When reconfiguring a ring, the function temporarily detaches a socket from packe...