EUVD-2026-49011

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

Linux Distros Unpatched Vulnerability : CVE-2026-64451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences...

PT-2026-64672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the func set flag function. The issue occurs when the function dereferences the tr-current trace flags variable before verifying if the active tracer...

CVE-2026-64235 x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

EUVD-2026-48644

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

USN-8604-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

PYSEC-2026-3461 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

The vulnerability of the `ftrace_modify_direct_caller()` function in the kernel/trace/ftrace.c module, which supports Linux operating system kernel tracing, allows a attacker to cause a service failure.

The vulnerability of the ftracemodifydirectcaller function in the kernel/trace/ftrace.c module, which supports kernel tracing in Linux operating systems, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-64028

A flaw was found in the Linux kernel's tracing subsystem. The histfieldname function, responsible for handling field names, can return a NULL value if a long variable name in a fully-qualified reference causes snprintf truncation. This unexpected NULL return can lead to a NULL pointer dereference...

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

CVE-2026-16439

CVE-2026-16439 affects Eclipse OpenJ9 up to version 0.60. The issue arises when using -Xtrace to trace method arguments, which can cause a buffer underflow. The NVD metrics show a CRITICAL base score (CVSS 3.1: 9.1) with no confidentiality impact but high integrity and availability impact; attack...

EUVD-2026-46338

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

SUSE CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

SUSE CVE-2026-64173

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

CVE-2026-64082

A flaw was found in the Linux kernel, specifically within the RISC-V architecture's handling of process tracing and signal restoration. When functions like compatriscvgprset or compatrestoresigcontext are invoked, they may process uninitialized stack data if a preceding user data copy operation...

The vulnerability of the enabled_monitors_start() function in the kernel/trace/rv/rv.c module, which supports Linux kernel tracing, allows a malicious actor to cause a service failure.

The vulnerability of the enabledmonitorsstart function in the kernel/trace/rv/rv.c module, which is part of the Linux kernel’s tracing support, relates to the use of a wrong type of resource. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-64173

A flaw was found in the Linux kernel. An issue in the tracing subsystem's memory management could lead to incorrect deallocation of tracing map elements. Specifically, the system attempts to free memory that was never successfully allocated, which can result in memory corruption. This vulnerabili...