Astra Linux – Vulnerability in Firefox and Thunderbird

Freeing arbitrary nsIInputStream's on a thread other than the one in which they were created could lead to a use-after-free, potentially causing a crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox and Thunderbird

The concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a “use-after-free” condition, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

SUSE CVE-2026-80862

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

CVE-2026-80862

This Linux kernel vulnerability affects the nvme-tcp subsystem. The page_frag_cache is used to preallocate PDU buffers for preallocated block device requests, but since block devices are created in parallel threads, the cache is accessed in a thread-unsafe manner. This leads to incorrect refcount...

CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

Linux Distros Unpatched Vulnerability : CVE-2026-80862

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in...

CVE-2026-59321

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

EUVD-2026-67202

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321

Spring Integration versions 7.1.0 , 7.0.0–7.0.5 , 6.5.0–6.5.10 , 6.4.0–6.4.12 , and 5.5.21 and earlier are affected by a thread-safety flaw in script-backed channels. A single JSR-223 ScriptEngine instance is shared across all messages without verifying the engine's THREADING capability. When a n...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

PT-2026-82724

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100759 advisory. In the Linux kernel, the following vulnerability has been resolved: drbd: Balance RCU calls in drbdadmdumpdevices Make drbdadmdumpdevices call rcureadlock before...

EUVD-2026-55573

In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 "can: raw: use bitfields to store flags in struct rawsock" the formerly separate integer values have been integrated into a single bitfield. This led to a...

CVE-2026-64260 fuse-uring: Avoid queue->stopped races and set/read that value under lock

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

CVE-2026-54497

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to renderin; if the same component, collection, or spacer component instance is reused...

AZL-91290 CVE-2026-54905 affecting package rubygem-concurrent-ruby for versions less than 1.3.7-1

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-53071

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp l2capecredreconfrsp calls l2capchandel without holding l2capchanlock. Every other l2capchandel caller in the file acquires the lock first. A remote BLE device can sen...

CVE-2026-53128

In the Linux kernel, the following vulnerability has been resolved: drbd: Balance RCU calls in drbdadmdumpdevices Make drbdadmdumpdevices call rcureadlock before rcureadunlock is called. This has been detected by the Clang thread-safety analyzer...

EUVD-2026-38996

In the Linux kernel, the following vulnerability has been resolved: drbd: Balance RCU calls in drbdadmdumpdevices Make drbdadmdumpdevices call rcureadlock before rcureadunlock is called. This has been detected by the Clang thread-safety analyzer...