Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-19 20:49Z
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74727 — Linux: In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74727

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (which only takes a refcount) and the subsequent spin_lock_bh(&ovpn->lock), a concurrent OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown can take ovpn->lock first, run ovpn_peer_remove() to unhash the peer from al CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74723 — Linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74723

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700 Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77 Call Trace: <TASK> dump_stack_lvl+0x5b/0x70 print_report+0xd1/0x610 kasan_report+0xe0 CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74712 — Linux: In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cm CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74711 — Linux: Casting it to struct sensor_device_attribute and reading the index field appears to access memory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbus_notify(), the code unconditionally casts every attribute to a struct sensor_device_attribute: drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() { for (i = 0; i < data->num_attributes; i++) { struct device_attribute *da = to_dev_attr(data->group.attrs[i]); struct sensor_device_attrib CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74705 — Linux: In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74705

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. Get the UDP header after the pull to avoid a potential use-after-free. CVSSv3.1 10.0 (CRITICAL)

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74704 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74702 — Linux: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74702

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES changes that bit later. Although virtio feature bits must not change after feature negotiation, vhost_scsi_set_fea CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74697 — Linux: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74697

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74691 — Linux: The setup path has not: commit ff7cd07f3064 ("net: thunderbolt: Enable DMA paths only after

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74691

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and tbnet_free_buffers() unmaps and frees the pages the frames sit in, so by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit, anything still in flight has nowhere to drai CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74690 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures. CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74688 — Linux: Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74669 — Linux: __ip_options_echo() treats a byte at that stale location as the option length and copies

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74669

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byt CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74665 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: fix skb length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution. After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reprodu CVSSv3.1 9.1 (CRITICAL)

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74662 — Linux: In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74662

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Crea CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74655 — Linux: In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74655

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops does not provide a flush_buffer callback, so an in-flight transfer can complete after serial core has reset the transmit kfifo, underflowing its length and resubmitting page-sized transfers indefinitely. Add one CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74651 — Linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74651

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE. The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74649 — Linux: In the case of an overflow, the driver can write out of bounds.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EI CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74631 — Linux: This fixes a refcount imbalance that can underflow page refcounts and trigger a use-after-free.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74631

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries through smc_rx_spd_release(), while queued entries are released later via the pipe buffer callback. The old post-splice accounting also derives the numb CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74629 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74629

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free). Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74628 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74628

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall sk->sk_timer after __x25_destroy_socket() has passed its cancel point. The fol CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74617 — Linux: In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditiona CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74616 — Linux: In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74616

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74615 — Linux: expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74615

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies); There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74614 — Linux: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74614

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's run CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74612 — Linux: In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution. After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, CVSSv3.1 10.0 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score