Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-13 19:59Z
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89635 — Linux: The reader in ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is still live thanks to the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every detached oplock to the reconnecting session: list_for_each_entry_rcu(op, &ci->m_op_list, op_entry, lockdep_is_held(&ci->m_lock)) { if (op->conn) continue; op->conn = ksmbd_conn_get(fp->conn); op->sess = work->sess; } The only key is op->conn == NULL, CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89634 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in symlink_data()") compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop a CVSSv3.1 9.1 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89633 — Linux: memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligne CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89632 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header: buf = (struct reparse_data_buffer *)((u8 *)io + off); len = sizeof(*buf); /* 8 bytes */ rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */ if (count < len || count < rdl CVSSv3.1 8.2 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89631 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89630 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv-> CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89626 — Linux: In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_group() fails after some groups have already been created, the function returns the error without removing the previously created groups. Add a local unwind path to remove the groups that were already created. With enable_sensor exposed only CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89615 — Linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record's lcns_follow. That count is checked only against the record's own length, not the target entry, so check_dp_table() (which validates the entry's lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and f CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89614 — Linux: KASAN reports a slab out-of-bounds read when a file on such a volume is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the ar CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89613 — Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89613

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89612 — Linux: The invalid value then propagated into the MFT zone allocator and could result in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_pe CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89611 — Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record. However, the validator does not check that name_offset is within safe boundaries for these operations or CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89610 — Linux: A malformed NTFS image with a crafted mapping pairs array could cause the kernel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89610

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation. Add validation to en CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89603 — Linux: In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89603

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89601 — Linux: In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89601

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had a construct like: if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); } which leads to lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditio CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89599 — Linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89599

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock. CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89588 — Linux: In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89588

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm header with (err + 1), the remaining length was reduced by sizeof(err) (pointer size) instead of sizeof(*err) (structure size). That overestimates the bytes left for cper_arm_err_info records and can let the parser read past the CPER section when err_info_num is large enough CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89586 — Linux: In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89586

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte ata_scsi_rbuf staging buffer, and the number of bytes copied is compared against the logical sector size by the caller: size CVSSv3.1 8.2 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89583 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eir_len -= dlen; eir_get_data() reports dlen as the field's data length, but the field spans dlen + 2 bytes once its length and type bytes count, and more when non-Service-Data fields were skipped to reach i CVSSv3.1 8.1 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89569 — Linux: KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd ----------- --------- rfcomm_session_get() CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89560 — Linux: In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in one of the lower layer file systems. For the userspace implementations of OverlayFS (fuse-overlayfs), whiteout objects can be created from userspace as well: * mknod(2) with S_I CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89558 — Linux: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations") converted still_degraded from int to bool, but inverted the assignment in the loop that checks whether the array will still be degraded after the current device is recovered: "still_degraded = 1" became "still_degraded = false". As a result, recover CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89555 — Linux: If an skb is constructed with the inner IP header in nonlinear data and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89555

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89554 — Linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89554

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89551 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89551

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->le CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score