CVE-2026-99008

A flaw was found in the Linux kernel's Bluetooth subsystem. When an RFCOMM Radio Frequency Communication terminal device fails to register properly during initialization, closing the device triggers a null pointer dereference in the shutdown handler. A local attacker could exploit this...

CVE-2026-99209

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could exploit this vulnerability to cause a Denial of Service DoS via a kernel crash. The issue occurs when evicting a graphics buffer object that lacks an assigned memory resource, causing the driver to dereference a NUL...

CVE-2026-99011

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between connection termination and incoming data handling in the Synchronous Connection-Oriented SCO protocol can lead to a use-after-free condition. An attacker within Bluetooth range or a local user could exploit this...

CVE-2026-99178

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. When an asynchronous page fault is interrupted by a Non-Maskable Interrupt NMI that also encounters a page fault, the kernel improperly clears the pending fault status flags belonging to the interrupted handler. A...

CVE-2026-99197

A flaw was found in the Linux kernel's Marvell mv643xx Ethernet driver. This flaw can result in a Denial of Service DoS by causing the system to crash during device initialization. The issue occurs because the driver attempts to attach the physical network interface before assigning its internal...

CVE-2026-99010

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. When a communication socket is closed while the underlying connection session remains active, incoming data packets are not released from memory. A remote attacker can exploit this vulnerability by...

CVE-2026-99003

A flaw was found in the Linux kernel's Panthor Direct Rendering Manager DRM driver. When the hardware firmware initializes fewer queue slots than the driver's hardcoded maximum, the driver fails to properly validate the requested queue count against the actual initialized firmware slots. A local...

CVE-2026-99013

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could cause a Denial of Service DoS due to a race condition during concurrent setup of Broadcast Isochronous Stream BIS socket listeners. By issuing simultaneous listen calls on the same broadcast socket, an attacker can...

CVE-2026-99001

A flaw was found in the Linux kernel's Intel Xe graphics driver. During device teardown, the driver fails to cancel pending background tasks before releasing associated device resources. A local privileged user could trigger this flaw by removing or unbinding the device while work is queued,...

CVE-2026-99175

A flaw was found in the Linux kernel. A race condition in the filesystem notification fsnotify subsystem allows mark additions to occur during connector teardown. A local unprivileged user can exploit this race by modifying inotify watches while reading file descriptor information, triggering a...

CVE-2026-99042

A flaw was found in the Linux kernel's iouring subsystem. When evaluating IPv6 network connections, security filters are supplied with zeroed address and port values if a caller provides a valid 24-byte address structure instead of the full 28-byte structure. A local attacker can exploit this fla...

CVE-2026-99215

A flaw was found in the Linux kernel's power supply subsystem. A race condition can occur if a power supply device is unregistered while an event callback is still executing, causing the driver data to be deallocated while still in use. This leads to a use-after-free condition where the kernel...

CVE-2026-99213

A flaw was found in the Linux kernel's VM sockets vsock subsystem. This issue allows a local user to cause memory corruption and trigger a system crash, resulting in a Denial of Service DoS. The vulnerability occurs due to a race condition between socket connection establishment and reset handlin...

CVE-2026-99009

A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication RFCOMM subsystem. A circular locking dependency can occur when an RFCOMM connection is initiated while a Bluetooth link is undergoing authentication or encryption. A local user can exploit this issue to trigger a...

CVE-2026-99198

A flaw was found in the Linux kernel's Actions Semi Owl Ethernet driver. When initializing or probing the network device with network traffic shaping enabled, the driver attempts to access network device operations before they are assigned. A local user capable of attaching or probing the device...

CVE-2026-99044

A flaw was found in the Linux kernel's ice network driver. During dynamic port cleanup, the driver prematurely frees internal interface memory before removing the port entry, resulting in a use-after-free condition. A local user could exploit this flaw to cause a Denial of Service DoS through a...

CVE-2026-99203

A flaw was found in the Linux kernel's pipe subsystem. Improper error handling during asynchronous input/output I/O notification setup can leave freed file structures referenced after an allocation failure. A local, unprivileged attacker could exploit this condition under memory pressure to trigg...

CVE-2026-99174

A flaw was found in the Linux kernel's ext4 file system. A local user could exploit a race condition during concurrent file path lookup and filesystem unmount operations. When resolving a symbolic link as the filesystem's last mount reference is released, the kernel may dereference a null pointer...

CVE-2026-99182

A flaw was found in the Linux kernel's Sound Open Firmware SOF audio subsystem. When handling aggregated audio capture configurations where the channel count is smaller than the number of aggregated devices, an integer underflow occurs in the IPC4 topology driver. A local user could trigger this...

CVE-2026-99200

A flaw was found in the Linux kernel's HiSilicon Fast Ethernet MAC hisifemac network driver. This flaw can result in a Denial of Service DoS due to a system crash during device probing. When initializing the network interface, the driver attempts to access network device operations before they ar...

CVE-2026-99206

A flaw was found in the Linux kernel's iSCSI target subsystem. A race condition occurs when concurrent processes update discovery authentication parameters through the configuration filesystem configfs without proper locking. A local user could exploit this vulnerability to trigger a double-free...

CVE-2026-99210

A flaw was found in the Linux kernel's accel/rocket driver. This flaw can lead to a Denial of Service DoS through a system crash under specific hardware initialization failure conditions. If initial device setup fails, the driver does not properly clear an internal reference pointer, leaving an...

CVE-2026-99207

A flaw was found in the Linux kernel's SCSI target subsystem. This issue allows a storage initiator or virtual machine guest to cause a Denial of Service DoS through a system deadlock. The vulnerability occurs because the subsystem fails to disable interrupts while holding an internal lock during...

CVE-2026-99176

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nested virtualization component. When loading nested virtual machine state fails during certain non-standard entry operations, KVM fails to reset the memory management unit MMU pointer back to the root context. A local user...

CVE-2026-99048

A flaw was found in the Google Virtual Ethernet gve driver in the Linux kernel. When disabling network buffer pools XSK pools, the driver attempts to re-acquire a network device lock that is already held. A local user with administrative privileges could trigger this flaw during queue management...

CVE-2026-99179

A flaw was found in the Linux kernel's watch queue subsystem, which can lead to a Denial of Service DoS. A race condition exists between queue resizing and notification delivery due to improper memory access ordering. A local, unprivileged user could exploit this flaw by concurrently resizing a...

CVE-2026-99000

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user can trigger a Denial of Service DoS by pinning and unpinning shared buffer objects repeatedly. Improper tracking of nested pin operations causes memory accounting counters to underflow, misleading the system into reportin...

CVE-2026-99043

A flaw was found in the Linux kernel's Intel Ethernet ice driver. This vulnerability can lead to a denial of service DoS caused by a use-after-free condition when network routing metadata is freed prematurely during representor interface teardown while packets remain queued for transmission. A...

CVE-2026-99002

A flaw was found in the Linux kernel's VMware Virtual GPU vmwgfx driver. A local user could exploit this flaw to cause a Denial of Service DoS or disclose sensitive memory contents through an out-of-bounds read. The vulnerability occurs because the driver fails to validate the pitch value provide...

CVE-2026-99208

A flaw was found in the Linux kernel's Intel Xe graphics driver. It allows information disclosure because memory buffers allocated for observation architecture OA streams are not cleared before being made accessible to user space. A local user can exploit this vulnerability by memory-mapping the...

CVE-2026-99005

A flaw was found in the Linux kernel's Intel i915 graphics driver. A race condition during power management state transitions allows background tasks to access hardware registers without holding the required power management locks after the graphics device has entered a parked state. A local user...

CVE-2026-118179

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Li...

CVE-2026-118180

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provid...

CVE-2026-118177

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local...

CVE-2026-118176

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email...

CVE-2026-118175

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, witho...

CVE-2026-117627

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped...

CVE-2026-117688

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. ...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-117557

A flaw was found in SDLimage. By tricking a user or application into processing a specially crafted Interleaved Bitmap ILBM image file, an attacker can trigger an out-of-bounds read condition during image decoding. This can lead to a Denial of Service DoS by causing the application to crash, or...

CVE-2026-117555

A flaw was found in cimg. An integer overflow vulnerability in the BMP image loader when calculating row dimensions can trigger an out-of-bounds memory read. An attacker can exploit this flaw by supplying a specially crafted BMP image file to an application using the library, potentially causing ...

CVE-2026-117548

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN rename operation uses an attribute's schema alias name such as "commonName" instead of its canonical name such as "cn" as the new relative distinguished name. An authenticated attacker with the ModifyDN...

CVE-2026-116695

A flaw was found in Crass. When parsing malformed URL tokens containing escaped backslashes, Crass incorrectly treats the closing parenthesis as escaped, retaining style declarations that web browsers interpret as active Cascading Style Sheets CSS. A remote attacker could supply crafted CSS to an...

CVE-2026-116773

A flaw was found in russh. An unbounded memory allocation issue allows a malicious Secure Shell SSH server to cause a Denial of Service DoS on connecting clients. By repeatedly sending crafted pre-authentication extension packets, the server forces the client to store an unlimited number of...

CVE-2026-116689

A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...

CVE-2026-116686

A flaw was found in mcp. Client sessions validate server-declared schema documents using a default resolver that automatically retrieves external network and local filesystem references. A malicious server can exploit this flaw to cause a Denial of Service DoS by stalling client sessions...

CVE-2026-116678

A flaw was found in Vaultwarden. When internal icon downloading is enabled, the server fails to properly validate secondary favicon web addresses extracted from untrusted pages against network access restrictions. A remote, unauthenticated attacker can exploit this vulnerability to cause...