CVE-2026-101724

CVE-2026-101724 affects MySQL Server, MySQL Cluster InnoDB. Affects MySQL 8.0, MySQL 8.4, MySQL 9.7...

CVE-2026-98995

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-99044

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99069

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-116147

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process...

CVE-2026-116152

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory...

CVE-2026-116140

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-115486

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet...

CVE-2026-116189

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious...

CVE-2026-98938

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

CVE-2026-98998

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98958

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

CVE-2026-98987

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-115386

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fdreaddir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-98878

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Onc...

CVE-2026-115380

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 polloneoff adapter, which performs On host work per subscription without consuming or checking fuel. Malicious guest modules can pass many...

CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the...

CVE-2026-115774

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...

CVE-2026-98903

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98917

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

CVE-2026-115383

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing...

CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98951

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

CVE-2026-98964

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98984

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dontmount on the victim and then detachmounts with the victim's inode locked. dolockmount takes the inode lock of the mountpoint and...

CVE-2026-98989

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98990

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-99007

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...

CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-98980

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98981

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98992

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-99053

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

CVE-2026-99027

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98954

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AFXDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx...

CVE-2026-99082

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...

CVE-2024-43768

security update...

CVE-2026-99034

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...