CVE-2026-118384

A flaw was found in mtools. This out-of-bounds write vulnerability allows an attacker to cause a Denial of Service DoS or corrupt memory. By tricking a user into processing a specially crafted disk image containing malformed VFAT directory entries, the application writes beyond allocated buffer...

CVE-2026-90037

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A race condition exists during the cleanup of NFSv4 client connections, specifically when the system attempts to reclaim resources from timed-out clients. This can lead to a use-after-free vulnerability, where the system trie...

CVE-2026-89997

A flaw was found in the Linux kernel's device mapper dm component. A local attacker could exploit a race condition between the resume and remove input/output control ioctl operations. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of...

CVE-2026-90000

A flaw was found in the Linux kernel's hid-rmi driver. A malicious or specially crafted Human Interface Device HID can provide undersized Remote Memory Interface RMI reports, leading to out-of-bounds memory access. This vulnerability allows for information disclosure, where sensitive heap content...

CVE-2026-90030

A flaw was found in the Linux kernel's DWC3 USB controller driver. When the forceRM bit is incorrectly set during an EndTransfer command, a transfer may remain active even after completion. A subsequent StartTransfer on the same endpoint can then trigger writes to an unmapped memory buffer, leadi...

CVE-2026-90001

A flaw was found in the Linux kernel's HID Human Interface Device BPF Berkeley Packet Filter component. A race condition exists between the device destruction and BPF link release paths, which can lead to a struct hiddevice being freed twice. This double-free vulnerability results in a...

CVE-2026-90014

A flaw was found in the Linux kernel's tracing subsystem. The showeventfilters and showeventtriggers files, which display event filters and triggers, do not correctly maintain a reference to the trace array. This allows the trace array to be freed while a user is actively reading these files...

CVE-2026-89968

A flaw was found in the nvmet-tcp component of the Linux kernel. A remote attacker can exploit this vulnerability by sending an unsolicited H2CData PDU Protocol Data Unit before the target transmits an R2T Ready To Transfer for a write command. This can cause the command to be completed twice,...

CVE-2026-90013

A flaw was found in the Linux kernel's tracing subsystem. When an options file is opened, it fails to properly manage references to the associated trace array. This oversight allows a local attacker to trigger a use-after-free condition by removing the trace array instance while the options file ...

CVE-2026-117608

A flaw was found in assimp. An attacker can exploit an integer overflow in the MD2 file parser by providing a specially crafted 3D model file with manipulated header values. When processed, this vulnerability triggers an out-of-bounds memory read, resulting in a Denial of Service DoS through an...

CVE-2026-93009

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. T...

CVE-2026-93010

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The...

CVE-2026-99123

A flaw was found in the Linux kernel's Virtual Sockets vsock virtio transport. Incoming packets for connecting sockets are not properly validated against their expected source address. A local, unprivileged attacker can exploit this vulnerability by sending crafted packets during connection setup...

CVE-2026-99130

A flaw was found in the Linux kernel's iouring subsystem. A local attacker can exploit this vulnerability to cause a Denial of Service DoS by triggering an infinite loop during process exit. This issue occurs when an exiting task attempts to cancel requests on an iouring ring with pending work th...

CVE-2026-99129

A flaw was found in the Linux kernel. A local user could exploit a time-of-check to time-of-use TOCTOU race condition during Security-Enhanced Linux SELinux permission checks for Berkeley Packet Filter BPF tokens. By altering a token file descriptor between kernel lookups, an attacker could bypas...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-99128

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A remote attacker can exploit this vulnerability to cause a Denial of Service DoS by sending specially crafted network packets with invalid chunk lengths. Because the packet parser fails to properly valida...

CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

CVE-2026-93007

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation tha...

CVE-2026-93011

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

CVE-2026-93008

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who...

CVE-2026-99194

A flaw was found in the Linux kernel's Aeroflex Ethernet driver. During device probing, the driver attempts to attach the physical network interface before its network device operations are assigned. A local user can exploit this condition on systems with network traffic shaping enabled to trigge...

CVE-2026-99126

A flaw was found in the Linux kernel's s390 CTCM Channel-to-Channel driver. A denial of service DoS can occur when the driver processes invalid Exchange Station Identification XID data during channel negotiation. If a peer XID is missing or a channel pairing mismatch occurs, the driver attempts t...

CVE-2026-99127

A flaw was found in the Linux kernel's page pool memory allocator. This vulnerability allows an attacker to cause a Denial of Service DoS by triggering network traffic that requests odd-sized memory fragments. Because the allocator does not properly align fragment offsets for odd-sized requests o...

CVE-2026-99125

A flaw was found in the Linux kernel's s390 Processor Activity Instrumentation PAI performance monitoring subsystem. A local user can trigger a Denial of Service DoS by generating heavy sampling workloads or manipulating event controls, causing the kernel to improperly handle consecutive stop...

CVE-2026-99124

A flaw was found in the Linux kernel's s390 PCI subsystem. A local user can trigger an out-of-bounds read and potential information disclosure by submitting an error report with a claimed length greater than the actual payload provided. This flaw causes uninitialized kernel memory past the...

CVE-2026-99121

A flaw was found in the Linux kernel's IPv4 networking component. A race condition in the fibrebalance function can cause a division-by-zero error when routing configurations change concurrently during route rebalancing. A local user or concurrent network event can trigger this flaw, causing the...

CVE-2026-99204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 Distributed Lock Manager DLM subsystem. A synchronization issue allows a local user to trigger a use-after-free condition by reading debugfs files while recovery data is concurrently being destroyed and released. This flaw...

CVE-2026-99122

A flaw was found in the Linux kernel. This flaw allows a Denial of Service DoS due to missing source validation in the Virtual Machine Communication Interface VMCI socket implementation. When handling incoming stream packets, the kernel can assign traffic to a connected socket without verifying...

CVE-2026-114820

The certificate authority CA store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue...

CVE-2026-93810

A flaw was found in the Linux kernel's CacheFiles module. An error-handling defect in the cachefilescreatetmpfile function causes a file reference to be released twice double fput during failure scenarios. A local user could exploit this vulnerability to trigger memory corruption, resulting in a...

CVE-2026-99190

A flaw was found in the Linux kernel's GPIO General Purpose Input/Output subsystem. When an operation setting multiple GPIO values encounters an error, the function exits early without releasing previously allocated memory buffers. A local user could trigger this error condition to cause a memory...

CVE-2026-98960

A flaw was found in the Linux kernel's Btrfs file system. When handling asynchronous input/output I/O requests through the iouring subsystem, allocated memory is not properly released if an operation encounters a retry condition and is canceled before completion. A local user could exploit this...

CVE-2026-99111

A flaw was found in the Linux kernel's Server Message Block SMB client. Inadequate locking during file truncation allows a local user to perform concurrent write operations while a file is being truncated. This race condition causes newly written data to be discarded silently, resulting in data...

CVE-2026-99102

A flaw was found in the Linux kernel's NTFS file system. The file resize operation fails to acquire the proper synchronization lock while updating on-disk file attributes and sizes. A local user can exploit this race condition by accessing memory-mapped files during a resize operation, causing...

CVE-2026-98947

A flaw was found in the Linux kernel's Virtual Sockets vsock subsystem during Virtual Machine Communication Interface VMCI datagram socket closure. When closing a datagram socket, incoming packets added to the socket's backlog can be moved back to the receive queue without proper cleanup. A local...

CVE-2026-98949

A flaw was found in the Linux kernel's Imagination PowerVR graphics driver. When splitting overlapping virtual memory mappings, the driver fails to release memory references and improperly links buffer objects. A local user can exploit this vulnerability by submitting crafted memory mapping...

CVE-2026-98948

A flaw was found in the Linux kernel's Mellanox Spectrum switch mlxsw driver. This flaw allows a local privileged user to cause a Denial of Service DoS by creating network flow classification templates that match port ranges. Because the driver fails to release port range registers allocated duri...

CVE-2026-99172

A flaw was found in the Linux kernel's inter-process communication IPC subsystem. When initialization of an IPC namespace fails during setup, internal message queue mounts are not properly released, causing kernel memory and resources to leak. A local user could exploit this flaw by repeatedly...

CVE-2026-99105

A flaw was found in the Linux kernel's schedext scheduler component. When a task is placed back onto a CPU's local dispatch queue under specific scheduler configurations, the kernel fails to reschedule the CPU, causing it to idle while tasks wait to execute. A local user can trigger this conditio...

CVE-2026-99106

A flaw was found in the Linux kernel's AMDGPU driver. This vulnerability allows a local attacker to cause a Denial of Service DoS through kernel memory exhaustion. When command submission operations fail during certain error-handling paths, allocated memory ranges and buffer object references are...

CVE-2026-99019

A flaw was found in the Linux kernel's SCSI changer driver, which can lead to a Denial of Service DoS. The driver retains unreleased device references after reading changer configuration data, preventing removed devices from being properly cleaned up. An attacker or local user interacting with SC...

CVE-2026-99049

A flaw was found in the Linux kernel's Xilinx General Purpose Input/Output GPIO driver. When a pin request fails, the driver does not properly decrement the runtime power management reference counter. A local user could trigger this failure to cause a resource leak, preventing the hardware...

CVE-2026-99214

A flaw was found in the Linux kernel's VideoCore IV VC4 HDMI driver. When audio playback initializes before video output is restored, the driver attempts to write audio configuration data to packet memory while it is still powered off. A local user initiating audio operations during display...

CVE-2026-99047

A flaw was found in the Google Virtual Ethernet gve driver in the Linux kernel. When stopping network queues and resetting the ring state, the driver fails to release eXpress Data Path socket XSK buffers posted to the network interface. A local user with network administrative privileges can...

CVE-2026-99211

A flaw was found in the Linux kernel's netlink subsystem. This vulnerability allows an unprivileged local attacker to read uninitialized kernel memory, resulting in information disclosure. The issue occurs because socket buffer headers are not properly reset before applying socket filters during...

CVE-2026-99040

A flaw was found in the Linux kernel's key management facility. This vulnerability allows a local user with write access to bypass security controls and add unauthorized keys to a restricted keyring. The issue occurs due to a race condition between key creation and the enforcement of keyring...

CVE-2026-99046

A flaw was found in the Linux kernel's Google Virtual Ethernet gve driver. A remote attacker could cause a Denial of Service DoS by generating network traffic that triggers receive errors on interfaces configured with zero-copy packet buffers. Because the driver fails to release the associated...

CVE-2026-99188

A flaw was found in the Linux kernel's stmmac Ethernet driver. Network link changes prior to a system resume can leave hardware status interrupts uncleared. When the system resumes from sleep, these pending interrupts trigger an interrupt storm that overwhelms the processor, resulting in a system...

CVE-2026-116696

A flaw was found in russh. This vulnerability can lead to a Denial of Service DoS due to unbounded memory consumption in the SSH agent service. A local process or a remote user with access to a forwarded agent socket can repeatedly submit keys containing an excessive number of confirmation...