Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-17 10:04Z
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80713 — Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80713

In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used io_uring, the exec cancellation path calls __io_uring_free(). This frees both the task context and the per-task restriction, so a ring created after exec is unrestricted. Split task context cleanup into io_uring_free_t CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80712 — Linux: spinand_otp_rw() enables OTP mode, reads, and disables it again, and mtd_otp_nvmem_add() does this during

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET_FEATURE qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD/NAND_EXEC_CMD and submits the descriptors, which makes the controller execute the command immediately. For SPINAND_SET_FEATURE the value to be written is only placed into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a second submission - so the chip is programmed with whatever CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80694 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80694

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80693 — Linux: Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2_OP_ALLOC_VECTORS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding its inner loop only by the per-chunk num_vectors. The array is sized separately: idpf_intr_reg_init() allocates kzalloc_objs(struct idpf_vec_regs, total_vecs) from caps.num_allocated_vectors and o CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80692 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80684 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure. CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80683 — Linux: sco_conn_del() then sees sk == NULL, its own put drops the count to zero

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a reference it does not own. It takes one transient reference via sco_conn_hold_unless_zero() and releases it with the sco_conn_put() that follows sco_sock_hold(); the additional put in the !sk branch releases a second one: conn = sco_conn_hold_unless_zero(conn); ... sk = sco_sock_hold(conn); sco_conn_unlock(con CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80681 — Linux: In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80681

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80678 — Linux: The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80674 — Linux: A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80674

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a *resident* attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_att CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80673 — Linux: A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80673

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80672 — Linux: For log_clients 410 it dereferences records up to ca + 409 * 160, ~64

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfs_check_restart_area() validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 ra_ofs, ra_len, ca_ofs; ... ra_len = ca_ofs + le16_to_cpu(ra->log_clients) * sizeof(struct log_client_record); if (ra_ofs + ra_len > le32_to_cpu(rp->syste CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80671 — Linux: Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: s CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80670 — Linux: Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80670

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validat CVSSv3.1 9.1 (CRITICAL)

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80668 — Linux: This removes the extra bump on the refcount for expectation timers, this allows to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80668

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectat CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80653 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0 Call trace: __device_links_no_driver+0xb4/0xc0 device_links_driver_cleanup+0xb0/0xfc __device_release_driver+0x198/0x23c device CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80645 — Linux: In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80645

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80638 — Linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80638

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. [CAUSE] When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root back to leaf mode with a bulk memset on &rb->rf_records. rf_records sits in an anonymous union with rf_li CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80635 — Linux: This causes an out-of-bounds read of stale heap data, corrupting the BA session state.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80634 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80634

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_for CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80633 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { ... dma_resv_assert_held(dmabuf->resv); ... } iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that re CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80630 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80630

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet o CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80617 — Linux: When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80617

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-28 08:16Z
HIGH

CVE-2026-80615 — Linux: memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2w ago
2026-08-28 08:16Z
CRIT

CVE-2026-80612 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80612

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the __sk_buff->data_meta pseudo-pointer to metadata. However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarde CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score