Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-25 23:58Z
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68352 — Linux: Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68352

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE l CVSSv3.1 8.3 (HIGH) · EPSS 34th percentile

TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68343 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68343

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond th CVSSv3.1 9.1 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68341 — Linux: In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68341

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have alrea CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68329 — Linux: CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68329

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68326 — Linux: A firmware-reported event->len larger than the bytes actually received makes assoc_req_ies_len describe IEs that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the (re)association request IEs that the firmware copies into the event: sinfo->assoc_req_ies = &event->data[len]; len = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control; sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len; event->len is supplied by th CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68302 — Linux: pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all free the old head and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68302

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that can reallocate that head before the cached pointer is used again. pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all fr CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68300 — Linux: This is incorrect when: 1.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. skb_clone() failed in the BH receive path, leaving auth_chunk NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this. 2. No CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68294 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68294

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() place CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68283 — Linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68283

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs tracepoint_synchronize_unregister() before freeing. That removed the synchronization the trigger .free callbacks used to get implicitly and inline from trigger_data_free(). event_hist_trigger_free() CVSSv3.1 8.8 (HIGH) · EPSS 31th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68240 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68240

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created. A CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68199 — Linux: The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68199

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Cl CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68198 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68198

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_ CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68196 — Linux: A response shorter than four bytes can also cause an out-of-bounds read of res->status_code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68196

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilc_parse_assoc_resp_info() computes the trailing IE length as ies_len = buffer_len - sizeof(*res); without first checking that buffer_len is at least sizeof(struct wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a received association response (host_int_parse_assoc_resp_info() passes hif_drv->assoc_resp / assoc_r CVSSv3.1 8.3 (HIGH) · EPSS 34th percentile

TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68192 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release. Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchb CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68179 — Linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68179

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock error paths nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the miscdevice ioctl entry and the CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68170 — Linux: A later mptcp_backlog_purge() then dereferences the stale pointer, triggering a warning in inet_sock_destruct() (ssk->sk_rmem_alloc

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68170

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb->sk reference on subflow close The backlog list is updated by mptcp_data_ready() under mptcp_data_lock(). The cleanup of backlog references to a closing subflow, however, was performed in mptcp_close_ssk(), before __mptcp_close_ssk() acquires the ssk lock, and while holding neither the ssk lock nor mptcp_data_lock(). Because that traversal ran without mptcp_data_lock(), concurrent soft CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68161 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68161

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregis CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68160 — Linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68160

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p CVSSv3.1 9.8 (CRITICAL) · EPSS 49th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68159 — Linux: A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_ CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68158 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow lead CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68156 — Linux: A subsequent msgr1 reconnect can therefore queue the stale pointer and trigger a KASAN

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cached values are then used by the messenger connect code when sending the authorizer. ceph_x_update_authorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt authorizer no longer f CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68154 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucke CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68149 — Linux: In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68149

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api") used this facility to opt out of posix acl caching for fuse inodes with fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl). The comm CVSSv3.1 8.4 (HIGH) · EPSS 3th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68144 — Linux: In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pep_get_sb+0x234/0x3b0 pipe_handler_do_rcv+0x5f7/0xa10 pep_do_rcv+ CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68142 — Linux: In the Linux kernel, the following vulnerability has been resolved: geneve: require CAP_NET_ADMIN in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68142

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in geneve->net can rewri CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score