CVE-2026-64539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64552

A flaw was found in the Linux kernel's virtio-net component. A malicious virtio backend can exploit an insufficient length check in the receivebig function, leading to an out-of-bounds write. This vulnerability can result in a denial of service DoS due to system instability or crashes...

CVE-2026-64547

A flaw was found in the Linux kernel's net1080 USB network adapter driver. A malicious NetChip 1080 device could send a specially crafted network frame with an invalid packet length. This could lead to an out-of-bounds read when processing the packet, causing a system crash and resulting in a...

CVE-2026-64555

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architecture, specifically affecting nested virtualization. The kvmhyphandlemops function, responsible for handling certain virtualization operations, incorrectly restored the SPSREL2 register. This occurred because...

CVE-2026-64540

A flaw was found in the Linux kernel's GeneLink GL620A USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus USB packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing...

CVE-2026-64551

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed error message, the system can be tricked into reading and the...

CVE-2026-64542

A flaw was found in the Linux kernel's IPv6 Neighbor Discovery NDISC component. An unprivileged user, operating within a network namespace, can trigger a null pointer dereference in the acceptuntrackedna function. This occurs due to a race condition where the inet6dev structure is re-fetched...

CVE-2026-64554

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...

CVE-2026-64546

A flaw was found in the Linux kernel. A specially crafted Extended Display Identification Data EDID, which describes display capabilities, can cause a heap out-of-bounds read in the drmparsetiledblock function within the drm/edid component. This vulnerability could lead to system instability or t...

CVE-2026-58347

A flaw was found in Moodle. Authenticated users could cause a Denial of Service DoS by providing an excessively long user profile description. This vulnerability is due to the absence of a defined maximum length for user profile descriptions, which could lead to resource exhaustion...

CVE-2024-5300

A flaw was found in Canonical snapd. The base AppArmor security profile configuration in snapd inadvertently allows strictly confined snap applications to bypass intended sandbox restrictions. This enables a compromised or malicious snap application, when running as root, to access sensitive syst...

CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-59676

A flaw was found in policycoreutils through 3.10 in seunshare. A TOCTOU race lets a local user running in an unconfined SELinux domain delete arbitrary root-owned files. Removing critical system files can cause denial of service; integrity impact is limited to unauthorized deletion...

CVE-2026-59677

A flaw was found in policycoreutils through 3.10 in seunshares. Missing authorization lets a local user in an unconfined SELinux context terminate other processes that are also unconfined, including root-owned ones. That can cause denial of service by killing critical processes...

CVE-2026-62426

A flaw was found in Xen. The system's sysctl operations utilize a global lock that lacks fairness in its acquisition mechanism. Additionally, when Xen Security Modules XSM with Flask are active, this lock can be acquired before proper permission checks are performed. This vulnerability could allo...

CVE-2026-62434

A flaw was found in Xen. When a guest operating system is started with Populated on Demand PoD enabled, it can attempt to reclaim memory pages that are not regular guest RAM. This action can lead to the corruption of Xen's memory management state, potentially causing system instability or denial ...

CVE-2026-62436

A flaw was found in Xen. This vulnerability arises during the process of switching the Grant Table, a mechanism for managing memory access between virtual machines, from version 2 back to version 1. During this transition, certain status information that is separate in version 2 is removed. If...

CVE-2026-62429

A flaw was found in Xen. A race condition exists where a guest's virtual Non-Uniform Memory Access vNUMA configuration data can be accessed by a device model even after the guest's domain destruction has started. This occurs because the cleanup of the vNUMA configuration is not synchronized with...

CVE-2026-62432

A flaw was found in Xen. A timing issue, known as a race condition, exists in the event channel handling mechanism. This occurs when the system attempts to expand event channels without properly securing access, allowing another operation to interfere. This can lead to the system attempting to...

CVE-2026-62433

A flaw was found in Xen. The DMOP handling code in Xen does not properly validate the number of buffers provided by the caller. This oversight can lead to the system accessing uninitialized memory, potentially resulting in information disclosure or other unpredictable behavior. A malicious guest...

CVE-2026-62431

A flaw was found in Xen. The logic responsible for handling periodic Viridian STIMERs performs a division operation using a value that can be controlled by a user. If a malicious user sets this divisor value to zero, it can lead to a division-by-zero error, resulting in a DE fault and causing a...

CVE-2026-42492

A flaw was found in Xen. Unprivileged domains can trigger an error in the virtual interrupt request vIRQ event channel binding, specifically within the management of a bitmap related to the VIRQDOMEXC. This error path can cause the bitmap to be improperly torn down, even if it was not correctly s...

CVE-2026-62430

A flaw was found in Xen. This vulnerability allows a guest operating system to read data beyond its intended memory boundaries, potentially leading to information disclosure. The issue arises from improper synchronization during access to the CMOS Complementary Metal-Oxide-Semiconductor memory. A...

CVE-2026-62428

A flaw was found in Xen. When processing grant-copy operations, a type confusion vulnerability can occur if the grant is already in use by another operation. This can lead to permission checks being performed on an incorrect memory page, potentially allowing an attacker to bypass security...

CVE-2026-62427

A flaw was found in Xen. The system-wide locks used for platform operations, which manage the system, do not ensure fair access. When Xen Security Modules XSM and Flask are active, these locks can be acquired before necessary permission checks are performed for certain operations. This could allo...

CVE-2026-62435

A flaw was found in Xen. When the Grant Table mechanism switches from version 1 to version 2, the number of valid grant references is reduced. A race condition can occur where code that temporarily releases and then re-acquires the grant table lock may make incorrect assumptions about the grant...

CVE-2026-64835

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

CVE-2026-56764

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

CVE-2026-64382

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-64260

A flaw was found in the fuse-uring component of the Linux kernel. A race condition exists where the queue-stopped flag is not consistently checked under a lock. This can allow a struct fusereq to be prematurely freed while other operations are still in progress, potentially leading to memory...

CVE-2026-64396

A flaw was found in ksmbd, a component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability in the SMB2LOCK deferred-lock cancellation mechanism. This flaw occurs when a file lock is freed prematurely while still being referenced, potentially leading to a system cras...

CVE-2026-64265

A flaw was found in the Linux kernel's fuse component. When a fuse request is interrupted and then resent, a specific interrupt entry intrentry is not properly cleared. If the requesting task subsequently receives a fatal signal, this uncleared entry can lead to a use-after-free condition. This...

CVE-2026-64300

A flaw was found in the Linux kernel's perf/aux subsystem. A use-after-free UAF vulnerability exists in the maprange function due to a race condition. This can occur when two performance events share a ring buffer, allowing a local attacker to map a memory page that has already been freed...

CVE-2026-47184

A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can send specially crafted multicast DNS responses. This can lead to uncontrolled memory growth, causing memory exhaustion and significantly degrading the performan...

CVE-2026-47180

A flaw was found in Zeroconf, a Python implementation of multicast DNS service discovery. An unauthenticated attacker on the local network can send a specially crafted multicast DNS mDNS packet with chained pointers. This can trigger a recursion error, leading to sustained CPU usage, excessive...

CVE-2026-47183

A flaw was found in zeroconf, a Python implementation of multicast DNS mDNS service discovery. An unauthenticated attacker on the local network can send specially crafted mDNS messages, causing the system to store an unbounded number of error messages. This can lead to excessive memory consumptio...

CVE-2026-48045

A flaw was found in zeroconf, a Python library for network service discovery. This vulnerability allows an unauthenticated attacker on the local network to send specially crafted queries. These queries can cause the system to retain large amounts of data and trigger excessive processing, leading ...

CVE-2026-48487

A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause...

CVE-2026-64481

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

CVE-2026-51304

A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the...

CVE-2026-51303

A flaw was found in SQLite. A remote attacker can exploit a use-after-free vulnerability in the core parsing component by sending specially crafted SQL queries. This can lead to an application crash, sensitive information disclosure, and potentially allow the attacker to execute arbitrary code on...

CVE-2026-64281

A flaw was found in the Linux kernel's svcrdma component. During transport teardown, threads waiting in svcrdmasqwait can hang indefinitely in an uninterruptible state. This occurs because these threads are not explicitly woken up when the transport closes, leading to them continuously holding...

CVE-2026-51296

A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information...

CVE-2026-51297

A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...

CVE-2026-64385

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

CVE-2026-41637

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC DoQ queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of...

CVE-2026-64369

A flaw was found in the Linux kernel, specifically within the s390 architecture. When the system attempts to read unaligned data that spans across memory pages, it can trigger exceptions. For memory pages designated for secure execution by the Ultravisor, the exception handling mechanism does not...