Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 13:29Z
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72157 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[]

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72151 — Linux: In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72151

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt tpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without installing a completion callback, discards both return values, and immediately frees the kpp_request via kpp_request_free(). When the resolved ecdh-nist-p256 KPP backend is asynchronous (atmel- CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72148 — Linux: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72148

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation is not atomic, concurrent calls to dw_edma_v0_core_start() can introduce race conditions if two channels update these registers simultaneously. Add a spinlock to serialize CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72146 — Linux: Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also l CVSSv3.1 8.4 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72139 — Linux: A concurrent softirq reader in __tcp_md5_do_lookup() / __tcp_md5_do_lookup_exact() (tcp_ipv4.c:1253, 1298) walks the same list

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72139

In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig_info kfree past RCU grace period in tcp_connect The md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c) has two symmetric branches: if (needs_md5) { tcp_ao_destroy_sock(sk, false); } else if (needs_ao) { tcp_clear_md5_list(sk); kfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...)); } Both branches free a per-socket auth-info object while the socket is in TCP_SYN_SENT CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72137 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe. Handle CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72136 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72136

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink xfrmi_changelink() operates on at most two netns, dev_net(dev) and the interface link netns xi->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in xi->net can rew CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72133 — Linux: This may result in calling complete() on an uninitialized completion, causing undefined behavior.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72133

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devm_request_irq() The driver calls devm_request_irq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm_request_irq(), the handler may execute before init_completion(). This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has bee CVSSv3.1 8.4 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72130 — Linux: Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72130

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and nvmet_a CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72129 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with i CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72124 — Linux: In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so->rx_lock The TX state machine (so->tx.state) is driven from three contexts: sendmsg() claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two hrtimers timing out a stalled transfer. Mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() calls made under so->rx_lock elsewhere left windows where a frame or CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72121 — Linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_f CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72115 — Linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIME CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72111 — Linux: The verifier then believes it knows the register's exact value, while at runtime the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check_mem_access() When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register c CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72107 — Linux: In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72107

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72100 — Linux: In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72100

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm_integrity_check_limits fails, the code would exit with DM_MAPIO_KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a deadlock. Let's move the limit check up, so that when it exits, no resources are leaked. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72098 — Linux: In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lamb CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72085 — Linux: That underflows it ("refcount_t: underflow; use-after-free") and, as the release function is not run

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0; the se_cmd is initialised (kref_init() via target_init_cmd()) only later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB path. The two error paths in scsiback_do_cmd_fn() take CVSSv3.1 9.3 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72084 — Linux: When the parameter list spans more than one page the buffer is a multi-page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72084

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling it how many bytes are valid. For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with an unbound CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72083 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72083

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapp CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72069 — Linux: In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72069

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p = rcu_dereference(ptr); rcu_assign_pointer(ptr, NULL); if (!p) return; spin_unlock(&p->lock); spin_lock(&p->lock) lock(&lock->lock); CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72065 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72065

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
CRIT

CVE-2026-72064 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack. This breaks RX CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72061 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipip6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel tha CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:21Z
HIGH

CVE-2026-72057 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabl CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score