Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-13 20:55Z
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89550 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss_unwrap(): if (len > xdr_stream_remaining(xdr)) goto unwrap_failed; offset = xdr_stream_pos(xdr); ... maj_stat = gss_unwrap(ctx, offset, offset + len, buf); The wire value `len` flows unchanged as the u CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89547 — Linux: Creating the broken service requires a percpu allocation failure during RPC server startup, so

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-pool percpu_counter stats and ignores every return value. On SMP, percpu_counter_init() fails when __alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed counter with fbc->counters == NULL and its embedded raw_spinlock_t, list_head, and count never initialized. __svc_create() returns the half-constructed sv CVSSv3.1 8.1 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89546 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_ CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89542 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89541 — Linux: A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive the client into

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with offset = (u8 *)(p) - (u8 *)head->iov_base; if (offset + opaque_len > rcv_buf->len) goto unwrap_failed; maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, offset + opaque_len, rcv_buf); Both operands are u32 and the sum is computed in u32. A repl CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89538 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89538

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf->len to a logical length, which can be much smaller than head[0].iov_len (the allocated receive-page capacity). It then calls xdr_buf_trim() with a trim length derived from the 16-bit "extra count" (ec) field in the Kerberos v2 token header. The ec field is authenticated by the post-decrypt memcmp() against the encryp CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89537 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89537

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first. The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx->krb5e->cksum_len (12-24, dependi CVSSv3.1 9.1 (CRITICAL) · EPSS 9th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89536 — Linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89536

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case t CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89535 — Linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89535

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svc_rdma_free() caches rdma->sc_cm_id->device before teardown, then calls rdma_destroy_id(sc_cm_id) which frees the cm_id. rpcrdma_rn_unregister() follows, but between those two calls the transport's sc_rn entry is still installed in the device's rd_xa. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the now-freed CVSSv3.1 8.1 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89534 — Linux: Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89534

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rd CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89533 — Linux: Combined with the boundary case above it also enables the u32 underflow path, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89533

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmetic defects in the per-segment loop produce wrong DMA lengths and a u32 underflow: pcl_for_each_segment(segment, chunk) { if (offset > segment->rs_length) { CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89532 — Linux: When the transport has negotiated Send-With-Invalidate, svc_rdma_get_inv_rkey() iterates all four PCLs with pcl_for_each_segment and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upper bound as &chunk->ch_segments[ch_segcount - 1]. ch_segcount is u32, so the subtraction wraps to 0xFFFFFFFF and the bound lands far past the ch_segments flex array. The loop body then walks unrelated memory at sizeof(struct svc_rdma_segment) CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89530 — Linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xpr CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89526 — Linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never compares the position against the received inline body length. In the single-chunk path, svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89524 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter t CVSSv3.1 8.1 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89513 — Linux: KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered: BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_ CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89504 — Linux: In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89504

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node. The function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Remove the of_node_put(np) call to let the device hol CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89495 — Linux: Three defects: - dlm_migrate_request_handler() passes migrate->namelen unchecked to dlm_init_mle(), which memcpy()s it into the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in a DLM domain can corrupt or panic any other node with a malformed message. Three defects: - dlm_migrate_request_handler() passes migrate->namelen unchecked to dlm_init_m CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89494 — Linux: As a result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the kmalloc(data_len) copy of the message (an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation. num_locks and lockname_len are bounded only on the sending side, and the message is never checked to actually carry num_locks migratable_lock entries. As a result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89493 — Linux: With this in place, a forged rl_used/rl_count is caught at block validation time (ocfs2_error())

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) { rec = &rb->rf_records.rl_recs[i]; ... rl_recs[] lives in a single metadata block (4096 bytes on the common configuration), so its real capacity is fixed by ocfs2_refcount_recs_per_rb(sb) (247 records f CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89492 — Linux: A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89492

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_n CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89485 — Linux: In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89485

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89482 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89482

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes processing") established that blk_rq_payload_bytes() must not be read without first checking blk_rq_nr_phys_segments(), and recorded the result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side was left as it was. The two differ for REQ_OP_WRITE_ZEROES, which CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89479 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, t CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89478 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89478

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until the chunk has been processed. An authenticated ASCONF DEL-IP can remove it in the meantime. sctp_assoc_rm_peer() takes the transport out of the association and CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score