CVE-2026-98872

A flaw was found in the Linux kernel's FreeVxFS filesystem driver. When encountering an unrecognized extent type in an on-disk structure, the driver triggers a fatal kernel panic instead of handling the error cleanly. A local user can exploit this flaw by querying file block mappings on a special...

CVE-2026-98876

A flaw was found in the Linux kernel's Host1x bus driver. This vulnerability can lead to a Denial of Service DoS by causing a system crash. During device initialization error handling, the driver attempts to access client operations without first verifying their presence. A local user capable of...

CVE-2026-98875

A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer uninitialized. A local user or process interacting with the...

CVE-2026-98871

A flaw was found in the Linux kernel's AMD Cryptographic Coprocessor CCP driver. This vulnerability can lead to a Denial of Service DoS due to a deadlock during AMD Secure Encrypted Virtualization SEV platform initialization. When an error occurs while configuring firmware memory, improper lock...

CVE-2026-98870

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active session lists. When the owning connection is subsequently tor...

CVE-2026-68476

A flaw was found in the Linux kernel's IP Virtual Server IPVS module. When processing network packets, a buffer reallocation can leave an IP header pointer referencing freed memory. An attacker could exploit this use-after-free condition to cause a Denial of Service DoS by crashing the system or...

CVE-2026-106073

A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...

CVE-2026-106074

A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt can be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If those APIs or dependents such as...

CVE-2026-106072

A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1, tls.checkServerIdentity may fail to classify the host as an IP address, normalize it to a canonical form, and match...

CVE-2026-106070

A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified directly or while compacting can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the...

CVE-2026-106071

A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example,...

CVE-2026-105481

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

CVE-2026-96581

A flaw was found in ash. In multitenant configurations, record creation actions configured to update existing entries upsert do not properly verify that conflicting records belong to the requesting tenant. An authenticated user can exploit this vulnerability by submitting a record identifier from...

CVE-2026-74433

A flaw was found in the Linux kernel's rxrpc component, specifically within the rxgkissuechallenge function. This Use-After-Free UAF vulnerability occurs because a memory page containing challenge content is prematurely freed before a tracepoint invocation, causing a pointer to reference freed...

CVE-2026-116124

A flaw was found in libgsf. A heap-based buffer overflow vulnerability exists in the OLE2 document parser within the oleinforeadmetabat function. A remote attacker could exploit this flaw by enticing a user to open a specially crafted file. Successful exploitation could lead to arbitrary code...

CVE-2026-109411

An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using...

CVE-2026-116190

A flaw was found in rclone. When interacting with WebDAV storage services, rclone inadvertently forwards user-configured custom credential headers to external destinations across HTTP redirects. A remote attacker who controls or influences a target redirect server could intercept sensitive...

CVE-2026-116195

A flaw was found in rclone. A path traversal vulnerability exists in the local storage backend where link suffixes are trimmed after directory containment checks are performed. By placing a specially crafted directory into a source tree synchronized with link and metadata flags enabled, an attack...

CVE-2026-116196

A flaw was found in Rclone. This vulnerability allows information disclosure due to improper handling of HTTP redirects within the Backblaze B2 storage backend. When download requests are redirected, the client inadvertently forwards sensitive account authorization tokens and Server-Side Encrypti...

CVE-2026-116194

A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery CSRF vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state an...

CVE-2026-116192

A flaw was found in rclone. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery SSRF. When the rc-serve feature is enabled, an attacker can provide a double-slash path on an existing configured remote to redirect backend...

CVE-2026-116187

A flaw was found in Rclone's S3 authentication proxy. This authorization bypass allows an authenticated tenant who obtains another user's upload identifiers to interact with in-progress multipart uploads across tenant boundaries. A remote authenticated attacker can exploit this flaw to inject...

CVE-2026-116189

A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signed checksum block, the attacker can cause the application t...

CVE-2026-116191

A flaw was found in Rclone's Web Distributed Authoring and Versioning WebDAV service. Due to improper validation of directory traversal sequences, a remote, unauthenticated attacker can send specially crafted WebDAV requests containing directory traversal sequences. This vulnerability allows the...

CVE-2026-74690

A flaw was found in the Linux kernel's s390/ism component. An interrupt handler could concurrently access data structures sba and ieq that have already been freed during the ismdevexit process. This Use-After-Free UAF vulnerability could lead to system instability or potentially allow for privile...

CVE-2026-80729

A flaw was found in the Linux kernel's memory management mm/hugememory component. When a folio is split, the workingset state may not be properly initialized, leading to an unlinked memory control group memcg charged node. This can cause the system to trigger a kernel warning during memory reclai...

CVE-2026-80731

A flaw was found in the Linux kernel's networking subsystem. A local user with CAPSYSRAWIO capabilities could trigger an out-of-bounds write in the devvalidateheader function. This vulnerability arises if a device's header length increases concurrently during packet processing, causing a memory...

CVE-2026-80737

A flaw was found in the Linux kernel's amba-pl011 serial driver. Improper synchronization during Direct Memory Access DMA teardown allows a transmit TX callback to access memory after it has been freed. This use-after-free vulnerability could lead to memory corruption and system instability...

CVE-2026-80760

A flaw was found in the Linux kernel's Bluetooth Management MGMT component. The mgmthcicmdsync function incorrectly handles the paramslen field, allowing a value greater than 255 to be processed. This mismatch between the declared parameter length and the actual appended data can cause the...

CVE-2026-80758

A flaw was found in the Linux kernel's futex subsystem. A race condition in the futexprivatehashput function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is dropped prematurely, enabling another process to free the memory while...

CVE-2026-80757

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux component. When an SELinux policy is loaded, the system fails to properly validate the number of permissions declared by a class that inherits permissions from a common set. This oversight can lead to an out-of-bounds heap...

CVE-2026-80754

A flaw was found in the Linux kernel's Synaptics RMI4 driver. During F55 sensor detection, a copy-paste error caused the transmitter TX electrode count to be incorrectly assigned the receiver RX electrode count. This miscalculation can lead to incorrect diagnostics report sizes and potential...

CVE-2026-80762

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the hciupdateeventfiltersync function attempts to access memory that has already been released. This Use-After-Free UAF vulnerability could allow a local attacker to...

CVE-2026-80765

A flaw was found in the Linux kernel's Hyper-V synthetic Human Interface Device HID host. A malicious Hyper-V host or backend can send a specially crafted initial device information message to a guest system. This message, containing an oversized HID report descriptor length, can cause the guest ...

CVE-2026-80766

A flaw was found in the Linux kernel's Human Interface Device HID uclogic driver. During the removal of a uclogic device, a timing issue allows the inrangetimer to be re-armed after it has been cancelled. This can lead to the timer attempting to access memory that has already been freed, resultin...

CVE-2026-80779

A flaw was found in the net/ionic component of the Linux kernel. This out-of-bounds write vulnerability occurs because the dedicated hardware timestamp RX queue's index can be used to access memory beyond the bounds of the normal transmit queue array. An attacker could potentially exploit this to...

CVE-2026-80782

A flaw was found in the Magic Mouse Human Interface Device HID driver within the Linux kernel. When the hidinputconnect function fails to register an input device, the driver may continue to use a pointer to memory that has already been released. This use-after-free vulnerability can lead to syst...

CVE-2026-80767

A flaw was found in the Linux kernel's Human Interface Device HID sensor custom driver. A use-after-free vulnerability exists where the enablesensor sysfs attribute can be accessed either before its associated memory is properly initialized or after it has been freed during device removal. A loca...

CVE-2026-80785

A flaw was found in the fbdev component of the Linux kernel. Improper synchronization during mode sysfs access allows a concurrent reader or writer to access freed memory. This can occur when showmode, showmodes, or storemode are called while storemodes is replacing and freeing the modelist. A...

CVE-2026-80790

A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could potentially exploit this to cause system instability or a...

CVE-2026-80805

A flaw was found in the Linux kernel's XFS filesystem. The xfsattr3leafverifyentry function fails to validate an attribute entry pointer before accessing its fields. A local attacker could exploit this by crafting a malicious attribute index nameidx to cause an out-of-bounds read. This could lead...

CVE-2026-80806

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorrect sequence in setting internal flags, which prevents the...

CVE-2026-80818

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. This vulnerability, a use-after-free, occurs when the system attempts to deinitialize a virtual interface during device teardown, accessing memory that has already been released. A local attacker or a malicious device could explo...

CVE-2026-80830

A flaw was found in the Linux kernel's USB subsystem. A race condition in the usbwakeupnotification function could allow a local attacker or a malicious USB device to trigger a use-after-free vulnerability. This could lead to system instability or a denial of service by causing the system to...

CVE-2026-80832

A flaw was found in the Linux kernel's QCE Qualcomm Crypto Engine cryptographic module. An issue with buffer underallocation in the qceaeadccmpreparebufassoclen function can lead to the allocated AAD Additional Authenticated Data buffer being smaller than required for DMA Direct Memory Access...

CVE-2026-80836

A flaw was found in the Linux kernel's virtio crypto driver. A malicious backend device could report a result length larger than the allocated buffer during an asynchronous cipher operation. This could lead to an out-of-bounds read, allowing the device to access adjacent kernel memory. This...

CVE-2026-80857

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. This vulnerability occurs when the system attempts to free memory associated with a FUSE request while it is still being actively used. A local attacker could potentially exploit this use-after-free condition to cause ...

CVE-2026-80860

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. A race condition exists between interrupt handling and request resending within the fuserequestfree function. This race condition can lead to a kernel warning, potentially causing system instability or a denial of...

CVE-2026-80875

A flaw was found in the IP Virtual Server IPVS component of the Linux kernel. When processing IPv6 packets with extension headers, the TCP state handling incorrectly parses the TCP header by using a fixed size for the IPv6 header instead of the actual transport-header offset. This can cause the...

CVE-2026-80883

A flaw was found in the Linux kernel's Tegra graphics driver drm/tegra: gr2d/gr3d. The host1xclientregister function is called before the address register map is fully initialized, making the device available to userspace prematurely. This timing issue could allow a local user to submit a job...