Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-29 06:05Z
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63952 — Linux: In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings. This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd th CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63947 — Linux: If a paired device sends a truncated packet, the handler reads beyond the valid

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bound CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63946 — Linux: A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elev CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63944 — Linux: A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63944

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use- CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63941 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in different way: - on ZCR_EL2 trap, ZCR_EL2.LEN is immediately capped at the VM's own VL limit. This has the potential to break existing SW that relies on the full LEN field to be stateful. - on ZCR_EL1 CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63940 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63940

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63939 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63939

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible size given the start of the guest-provided pointer, and the end of the shared buffer. The code was "fine" when first introduced, as KVM doesn't consult the length of the buffer when CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63938 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63938

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer. CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63937 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is a CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63926 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63926

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and lea CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63925 — Linux: In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63925

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker that captures the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63924 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63924

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63923 — Linux: An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mail CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63922 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63922

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing p CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63921 — Linux: In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63921

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns * CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63919 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63919

In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespac CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63917 — Linux: Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63917

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63916 — Linux: If HID_DG_INPUTMODE is in a field other than the first one and the first

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field. If HID_DG_INPUTMODE is in a field other than the first one and the first field has a report_count smaller than the usage_index of HID_ CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63915 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63915

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches these functions, causing an out-of-bounds heap read of packet->header. The same 0 CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63913 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether t CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-19
2026-07-19 16:17Z
CRIT

CVE-2026-63912 — Linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined a CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63909 — Linux: This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63909

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check beco CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63906 — Linux: In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63906

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths. CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63893 — Linux: For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->device_name /

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63893

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > block_len check. tb_property_parse() then passes entry->value to parse_dwdata() as a dword offset into the property block, reading atta CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-19
2026-07-19 16:17Z
HIGH

CVE-2026-63889 — Linux: This is not a local userspace or IP network path; the attacker must be

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63889

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_ CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score