CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64371

CVE-2026-64371 is a race condition in the Linux kernel procfs subsystem where several functions call ptrace_may_access() without exec_update_lock protection. The affected functions include do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and...

PT-2026-64592

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the procfs component where the ptrace may access function is called without the necessary exec update lock protection. This lack of locking occurs within the following...

CVE-2026-63802

CVE-2026-63802 affects the Linux kernel’s blk-cgroup code. The vulnerability is a use-after-free that can occur when multiple blkgs in the same blkcg are released concurrently. The race happens as __blkcg_rstat_flush() can remove another blkg’s iostat entries via llist_del_all(), leading the seco...

alation-ai-agent-mcp (1.0.0rc3), codesecure-mcp (1.0.0b9) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.14.0)

fastmcp PYPI version 2.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alation-ai-agent-mcp 1.0.0rc3 - codesecure-mcp 1.0.0b9 - korean-stat-mcp 0.1.4 - mcp-proxy-for-aws =1.1.5, =0.3.0, =0.5.0 - seclab-taskflow-agent...

Zookeeper Unauthenticated Enumeration

Collects Zookeeper srvr/stat/conf output via unauthenticated four-letter commands. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Zookeeper four-letter-word admin commands without authentication.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()

A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...

ALSA-2026:36349 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable CVE-2026-43450 kernel: sctp: revalidate list cursor...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in...

kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()

A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...

EUVD-2026-25022

ln: rejects non-UTF-8 source filenames in target-directory mode...

EUVD-2026-41922

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat follows symlinks instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount e.g. a...

alation-ai-agent-mcp (1.0.0rc3), codesecure-mcp (1.0.0b9) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.14.0)

fastmcp PYPI version 2.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alation-ai-agent-mcp 1.0.0rc3 - codesecure-mcp 1.0.0b9 - korean-stat-mcp 0.1.4 - mcp-proxy-for-aws =1.1.5, =0.3.0, =0.5.0 - seclab-taskflow-agent...

EUVD-2026-39864

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers and t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/damon/stat: A memory leak was fixed in the case of failures during damonstatstart. The DAMON context is destroyed, and the global pointer is reset when damonstart fails. Otherwise, the context allocated by damonstatbuildctx ma...

PT-2026-50771

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.2 Description An infinite loop Denial of Service DoS occurs during the process-tree walk when a parent process exits during authentication. The function usb get process parent id fails to initialize the ppid...

CVE-2026-9270

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The sendstats method does not remove newlines from metric names $stat variable, allowing attackers to change t...

CVE-2026-46259

A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...

CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...

CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...