Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 11:24Z
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72360 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT messages as this would result in breaking the VFPF ABI protocol and also might trigger an assert on the PF side. (cherry picked from commit 1714d360fc5ae2e0886a69e979095d9c7ff3568a) CVSSv3.1 8.4 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72355 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72355

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72354 — Linux: Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni->runlist.lock, drops the lock, and later uses rl->length and rl->vcn when choosing folio_sz. That pointer is only borrowed from ni->runlist.rl. Concurrent $MFT allocation extension can merge a replacem CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72353 — Linux: Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_attr_fallocate+0xbb8/0xd00 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfs_attr_fallocate() allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni->runlist.lock. The returned struct runlist_element is only a borrowed pointer into ni->runlist.rl. A writer can replace and free that array after the read lock is dropped, so later reads of rl->lcn, rl->length and CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72351 — Linux: In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72351

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even when GUE_PFLAG_REMCSUM is set. This lets a packet with only the private flags field pass validate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum() r CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72348 — Linux: Set hotdrop to true and drop malformed packets so they cannot bypass rules intended

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72348

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header length for matching. For the ah match, add the missing advertised-length check. For hbh and rt, update the existing advertised-length checks. In all three cases, set hotdrop to true bef CVSSv3.1 9.1 (CRITICAL) · EPSS 14th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72343 — Linux: Once channels are opened (priv->stats_nch > 0) and the hypervisor enables stats reporting, mlx5e_hv_vhca_stats_work()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5e_hv_vhca_stats_create() is called from mlx5e_nic_enable(), before mlx5e_open(). At that point priv->stats_nch is still zero, because it is only ever incremented in mlx5e_channel_stats_alloc(), which is reached only from mlx5e_open_channel(). mlx5e_hv_vhca_stats_buf_size() therefore returns 0, and kvzalloc(0, GFP_KERNEL) returns ZERO_SIZE_PTR (( CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72342 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72342

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5e_hv_vhca_stats_create() registers the stats agent through mlx5_hv_vhca_agent_create(). The helper publishes the agent in hv_vhca->agents[type] under agents_lock and immediately schedules an asynchronous control invalidation on the HV VHCA workqueue before returning to mlx5e. The asynchronous invalidation invokes the control agent's invalidate callba CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72339 — Linux: This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72339

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72334 — Linux: If controller sends malformed sequence ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends malformed sequence ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If con CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72329 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72329

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci_dev LUT The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST. Replace the cached VF mapping with runtime lookup on the m CVSSv3.1 9.3 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72323 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72323

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP timer callback. During device destruction, inetdev_destroy() drops the primary reference to in_device, which can drop its refcount to 0. The actual freeing of in_device memory is deferred via RCU (usin CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72322 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72322

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72320 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOK CVSSv3.1 9.1 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72319 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb_pull() we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom for functions like ipv4_update_pmtu(), icmp_send() and IP_VS_DBG(). Also, add more checks for the length of the inner headers. CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72318 — Linux: The resulting negative max_len is then passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72318

In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets are used to compute the DfsPath and NetworkAddress string pointers without checking whether they still point inside the response buffer. A malformed referral can therefore make CVSSv3.1 9.4 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72317 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72317

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker. xs_connect() stores task->tk_client in sock_xprt::clnt as a raw pointer and queues the worker; for TLS-secured transports that worker is xs_tcp_tls_setup_socket(), which reads several fields out of the saved pointer (cl_timeout, cl_program, cl CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72310 — Linux: Use size_add() for the offset plus length check so overflow is treated as out

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer l CVSSv3.1 8.1 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72299 — Linux: In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72299

In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize against the socket owner consuming or purging sk_receive_queue. KASAN reported: CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy) Hardware name: CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72298 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel CVSSv3.1 8.4 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72296 — Linux: With a malformed IFE frame, the inner Ethernet header may still be shorter than

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72296

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area. With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which CVSSv3.1 9.1 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72295 — Linux: In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-72294 — Linux: In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72294

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here add irq validility cheking in kvm_vcpu_ioctl_interrupt(). CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72291 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72291

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try_get_locked_pte() Fix an unlikely race in try_get_locked_pte(), which could have happened if puds or pmds get unmapped between the p?dp_get() and p?d_offset() functions. CVSSv3.1 9.3 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-72289 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72289

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq)) before moving the interrupt, which assumes that an interrupt whose affinity is preserved is still queued on this vCPU's CVSSv3.1 9.3 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score