CVE-2026-59321: Concurrent Execution using Shared Resource with Improper Synchronization

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

PT-2026-82513

Name of the Vulnerable Software and Affected Versions ccoap version 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 Description A null pointer dereference occurs in the server-side session management logic. This is caused by a race condition—a situation where the timing or order of events affects the...

CVE-2026-59324: Concurrent Execution using Shared Resource with Improper Synchronization

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

PT-2026-82835

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.6 Description A flaw in the cluster file synchronization process allows an entity possessing the cluster key to write, overwrite, or delete arbitrary files within the /var/ossec directory on worker nodes,...

CVE-2026-26456

A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...

ROS-20260827-73-0034

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-67097

A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...

CVE-2026-26456

A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 . The root cause is a race condition occurring between the request dispatch thread and the session cleanup thread when they access shared session list node...

CVE-2026-26456

A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...

CVE-2026-80572

CVE-2026-80572 is a use-after-free in the byd psmouse (touchpad) driver in the Linux kernel . During device disconnection, byd_disconnect() calls timer_delete() before freeing the driver's private data, but this does not wait for a potentially running byd_clear_touch() callback that dereferences ...

The vulnerability of the gether_disconnect() function in the drivers/usb/gadget/function/u_ether.c module of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the getherdisconnect function in the drivers/usb/gadget/function/uether.c module of the Linux device driver framework is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to cause a service...

The vulnerability of the dt2815_attach() function in the drivers/comedi/drivers/dt2815.c module, which supports Linux kernel-based data collection devices, allows a hacker to trigger a service failure.

The vulnerability of the dt2815attach function in the drivers/comedi/drivers/dt2815.c module, which supports Linux kernel-based data collection devices, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to cause service...

The vulnerability of the walk_pud_range() function in the mm/pagewalk.c module of the Linux kernel’s memory management subsystem allows a hacker to cause a service failure.

The vulnerability of the walkpudrange function in the mm/pagewalk.c module of the Linux kernel’s memory management subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-82188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the byd disconnect function. The function uses timer delete before freeing the driver's private data, which fails to wait for a running byd clear touch callbac...

ROS-20260826-73-0017

The vulnerability of the gfs2showoptions function in the fs/gfs2/super.c file of the GFS2 file system in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260826-73-0016

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260826-73-0014

The vulnerability of the ext4rename function in the fs/ext4/namei.c file of the Ext4 file system in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

ROS-20260826-73-0008

The vulnerability of the ath6klhtcpiperxcomplete function in the drivers/net/wireless/ath/ath6kl/htcpipe.c file of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow...

CVE-2026-13479: Out-of-bounds Read

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...

The vulnerability of the smbdirect_socket_init() function in the fs/smb/common/smbdirect/smbdirect_socket.h module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the smbdirectsocketinit function in the fs/smb/common/smbdirect/smbdirectsocket.h module of the Linux kernel is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...