CVE-2026-74531 Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: hold conn reference in abortconnsync There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-72110

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

UBUNTU-CVE-2026-72110

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

UBUNTU-CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-74318

CVE-2026-74318 concerns the Linux kernel, specifically a deadlock in btrfs when cloning an inline extent while using the flushoncommit option. The issue occurred during reflink/transaction commit, where copying inline extent data to a destination file could deadlock if the destination offset was ...

CVE-2026-72152 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE. With CONFIGDEBUGATOMICSLEEP this triggers a warning when the IRQ wai...

CVE-2026-72110 bpf,fork: wipe ->bpf_storage before bailouts that access it

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

CVE-2026-72110 bpf,fork: wipe ->bpf_storage before bailouts that access it

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

CVE-2026-72110

The CVE-2026-72110 entry documents a Linux kernel issue in which a nascent task may bail out of copy_process() to free_task() before p->bpf_storage is initialized, causing the nascent task’s bpf_storage pointer to be a stale copy from the parent. This can lead to kernel hangs or use-after-free...

CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086

The CVE-2026-72086 entry describes a Linux kernel vulnerability in the pvSCSI/scsiback path for Xen where, on the TMR submit-failure path, a command tag could be leaked instead of freed. Specifically, scsiback_device_action() obtains a tag, submits target_submit_tmr(), and on failure the err path...

CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

CVE-2026-72071: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

PT-2026-72275

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's SCSI xen scsiback component where the scsiback device action function fails to free a command tag when a task-management request submitted via targe...

Malware in redux-saga-task-cancel-rce

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: zarf, trivy-operator, task, syft, tfsec, steampipe, grype, snyk-cli, wolfictl, kubescape, opentofu, conftest, kots, k9s, xeol, trivy, zot, tflint, terragrunt, terraform...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: chezmoi, argo-workflows, pulumi, zarf, k8sgpt, melange, task, scorecard, syft, flux-image-automation-controller, guac, timoni, argo-events, flux, flux-source-controller, tfsec, pulumi-language-yaml, skaffold, kubevela, grype, snyk-cli, gptscript, bom, go-licenses,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: chezmoi, argo-workflows, pulumi, zarf, k8sgpt, melange, task, scorecard, syft, flux-image-automation-controller, guac, timoni, argo-events, flux, flux-source-controller, tfsec, pulumi-language-yaml, skaffold, kubevela, grype, snyk-cli, gptscript, bom, go-licenses,...

MazeRunner: Nonlinear Task and Clue Orchestration for LLM-Driven Black-Box Automated Penetration Testing

Penetration testing is essential yet resource-intensive. Although large language models LLMs show promise for automating security auditing, existing agents mainly execute end-to-end workflows in simplified linear scenarios. Real-world black-box testing is fundamentally nonlinear: the attack graph...