Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-17 20:28Z
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80586 — Linux: In this case, the first suboption will be ignored, but leaving some fields written

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80586

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80585 — Linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80585

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. CVSSv3.1 9.4 (CRITICAL)

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80584 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80584

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with if ((udata_len - udata_offset) < len) Both fields are u32, so a udata_ CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80576 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80574 — Linux: In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80574

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1]. CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80561 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80561

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 byte CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80558 — Linux: Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80557 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply with struct_len=0, ceph_start_decoding() returns success with p == end, leaving CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80554 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80554

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined num CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80553 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80553

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80552 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80552

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80551 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80551

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80549 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80549

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock). Push the cleanup of the private->cp resources to a workqu CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80548 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80548

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of races that are possible, the choices are either to: A) expand the scope of io_mutex to close these remaining windows, or B) reduce the scope of io_mutex to just io_region, and in CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80547 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-26 15:17Z
HIGH

CVE-2026-80536 — Linux: Found and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted image trips a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80536

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT), item->ri_buf[i].iov_base, nbits << XFS_BLF_SHIFT); The destination offset (bit/nbits, from the logged dirty bitmap) and the buffer size (from the logged blf_len) are bo CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80528 — Linux: In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->jour CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:17Z
CRIT

CVE-2026-80519 — Linux: In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can s CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74752 — Linux: A forged RANDOM length can cause out-of-bounds reads during key-vector construction.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during k CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74751 — Linux: With the adjusted boundary, t4 can equal t0, and entering the loop with stale

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74751

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REG_L t1, SZREG(t0) // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu t0, t4, 4f // boundary check AFTER load where t4 = (s + count) & -SZREG. When s is aligned and count is a multiple of SZREG, t4 CVSSv3.1 9.4 (CRITICAL)

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74746 — Linux: KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74746

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74744 — Linux: This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74744

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet hea CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74743 — Linux: This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74743

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom f CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-74737 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag tha CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-26 15:16Z
CRIT

CVE-2026-54523 — Kyverno: A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54523

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/co CVSSv3.1 9.6 (CRITICAL)

CWECWE 862VNDKyvernoTYPVulnerability
9.6
CVSS v3.1
98
Edit Score