CVE-2026-74730: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

Linux Distros Unpatched Vulnerability : CVE-2026-76641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parse...

AZL-96932 CVE-2026-76641 affecting package expat for versions less than 2.8.3-2

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...

ALPINE-CVE-2026-76641

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...

expat2 -- Out-of-bounds Read

https://github.com/libexpat/libexpat/pull/1331 reports: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between...

ANT-2026-MHV0A2SD · FreeType2 · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-MHV0A2SD: Heap buffer overflow in Type 1...

PT-2026-76715

The flash copy system call is verified by z vrfy flash copy in drivers/flash/flash util.c. On builds with CONFIG USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer K SYSCALL MEMORY WRITE and passed the two...

AZL-96111 CVE-2026-74458 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

UBUNTU-CVE-2026-72172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

UBUNTU-CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

EUVD-2026-58930

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: fix uninitialized struct pages for ZONEDEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate reuses the unoptimized boot memmap. However, compoundnrpages still assumes th...

CVE-2026-72172

CVE-2026-72172 affects the Linux kernel, specifically the mm/mm_init path related to ZONE_DEVICE. The issue occurs when DAX memory is hotplugged into an unoccupied subsection of an early section, causing section_activate() to reuse the boot memmap while compound_nr_pages() assumes vmemmap optimiz...

EUVD-2026-59100

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

PT-2026-72563

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AFS component where the afs vnode::lock work variable is not sufficiently initialized. Initializing it only once within the slab's init function is inadequate for...

PT-2026-72360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management initialization where section activate reuses the unoptimized boot memmap when DAX memory is hotplugged into an unoccupied subsection of an early...

PT-2026-72545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the x86 uprobes implementation where the in uprobe trampoline function incorrectly uses current-mm for VMA Virtual Memory Area lookup during the unregister path. This...

PT-2026-72966

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 PCI component regarding memory accounting for pinned and unpinned pages. The account mem and unaccount mem functions call get uid, which increments the...