Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 10:48Z
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72466 — Linux: In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer and drain the Receive queue. First, the speculative peek p = xdr_inline_decode(xdr, 0); /* five p++ reads follow */ asks xdr_inline_decode() for zero bytes, which re CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72463 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72463

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72462 — Linux: Accessing the path outside of the state lock allows for a race with unix_release_sock().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72462

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with unix_release_sock(). Fix this by taking the state lock and getting a reference to the path under lock. Ideally for connected sockets we would cache this information so we don't have t CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72451 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the state after it passed the validity check, and then the insertion will add the dead state to the cache. Fix this by moving the validity check inside the lock. This entire function is called on the i CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72442 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet processing. Move ctx->offset update inside the IPPROTO_IPV6 conditional block since it should only be adjusted when an IP6IP6 tunnel is actually detected. Simplify th CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72436 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72429 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dst_entry IOAM uses a dummy dst_entry(null_dst) to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dst_cache_set_ip6(). However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which treats the dst_entry as part of a struct rt6_info. Since the null_dst was embedded directly a CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72426 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72426

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup __clean_func_state() cleans dead stack slots in 4-byte halves. When the high half of a STACK_SPILL slot is dead and the low half remains live, cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears the saved spilled_ptr metadata. That conversion is safe only for scalar spills. For a pointer spill, this metadata clear lets a la CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72423 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72423

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside t CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72422 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preauth_info is shared connection state (struct preauth_integrity_info, kmalloc-96) that is allocated and freed by the SMB2 NEGOTIATE handler and read by the response send path. smb2_handle_negotiate() allocates conn->preauth_info, and on a deassemble_neg_contexts() failure kfrees it and sets it to NULL. Both the allocation CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72421 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72421

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table: # unshare -n # ip link set lo up # ip route add 19 CVSSv3.1 10.0 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72420 — Linux: In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72420

In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races while breaking stripe batches KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op).. and .. one possible scenario is: CPU1 CPU2 break_stripe_batch_list(sh1) -> handle sh2 -> lock(sh2) -> sh2->batch_head = NULL -> unlock(sh2) -> test_and_clear_bit(R5_Overlap, sh2->dev[i] CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72417 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72417

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto and reference ctx->tun.hdr_size when updating ctx->offset. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72412 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72412

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of _PAGE_UNUSED pte bit The _PAGE_UNUSED softbit should not really be lying around. Its sole purpose is to signal to try_to_unmap_one() and try_to_migrate_one() that the page can be discarded instead of being moved / swapped. KVM has no way to know why a page is being unmapped, so it sets the bit on userspace ptes corresponding to unused guest pages every time they get unmapped. KVM h CVSSv3.1 9.3 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72408 — Linux: On a tunnel without the hint, receive aggregates the frames as plain ETH_P_TEB while

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72408

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(), which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT (gs->gro_hint). geneve_gro_complete() instead calls the low-level geneve_opt_gro_hint_off() and acts on the hint unconditionally. On a tunnel without the hint, receive aggregates the frames as plain ETH_P_ CVSSv3.1 10.0 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72407 — Linux: the out-of-bounds completion.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72407

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated on gs->gro_hint, geneve_gro_complete() re-derives the inner dispatch type and length from the packet and the current gs->gro_hint, independently of geneve_gro_receive(). The two can disagree if gs->gro_hint flips under a concurrent geneve_quiesce()/ geneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), CVSSv3.1 10.0 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72399 — Linux: However, the number of fragments contained in xdp_frame may be greater than or equal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72399

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp_frame The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the number of fragments contained in xdp_frame may be greater than or equal to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr to be out of bounds. CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72398 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72398

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, where the server unpacks it and reconstructs the original INIT chunk. When cookie authentication is enabled, the cookie contents are protected against tampering, so reusing the unpacke CVSSv3.1 9.8 (CRITICAL) · EPSS 16th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72393 — Linux: BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72393

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task swapper/5/0 Call Trace: fbnic_tx_lso.isra.0+0x668/0x8e0 fbnic_xmit_frame+0x62 CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72382 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t. A malicious client can reach this with: SMB CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72381 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id race the fp->owner.name compare-read in ksmbd_vfs_compare_durable_owner() against the kfree() in ksmbd_reopen_durable_fd()'s reopen-success path. fp->owner.name is a standalone kstrdup() buffer whose lifetime is independent of the fp refcount, and the two sit CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72380 — Linux: A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72380

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req_id before indexing rsp[] pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation. req_id was al CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72367 — Linux: In the Linux kernel, the following vulnerability has been resolved: iomap: guard io_size EOF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard io_size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid data within EOF. This trims io_size when a writeback range extends past end_pos: ioend->io_size += map_len; if (ioend->io_offset + ioend->io_size > end_pos) ioend->io_size = end_pos - ioend->io_offset; CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72366 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle async cache object creation netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped. Fix this by removing the checks on the cookie and delegating this CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72360 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT messages as this would result in breaking the VFPF ABI protocol and also might trigger an assert on the PF side. (cherry picked from commit 1714d360fc5ae2e0886a69e979095d9c7ff3568a) CVSSv3.1 8.4 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score