Thu, Sep 11 · 05:15 PM CDTCVE-2025-39758
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* C
CVECVE-2025-39758
SeverityCRITICAL
TypeUPDATED
PublishedThu, Sep 11 · 05:15 PM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-68082
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_32(p) at the num_lockers fi
CVECVE-2026-68082
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 08 · 10:16 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-68136
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marke
CVECVE-2026-68136
SeverityCRITICAL
TypeUPDATED
PublishedMon, Aug 10 · 01:19 PM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-68159
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both
CVECVE-2026-68159
SeverityCRITICAL
TypeUPDATED
PublishedMon, Aug 10 · 01:20 PM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72041
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting
CVECVE-2026-72041
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72065
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.
CVECVE-2026-72065
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72069
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p =
CVECVE-2026-72069
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72084
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling
CVECVE-2026-72084
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-50540
9.6/10 · Must read/watchNVDvuln
Summary
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontaine
CVECVE-2026-50540
SeverityCRITICAL
TypeUPDATED
PublishedFri, Aug 07 · 09:17 PM CDT
ModifiedMon, Aug 24 · 06:19 AM CDT
CVE-2026-16242
9.4/10 · Must read/watchNVDvuln
Summary
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could co
CVECVE-2026-16242
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jul 20 · 08:16 AM CDT
ModifiedMon, Aug 24 · 08:16 AM CDT
CVE-2026-64269
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from
CVECVE-2026-64269
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-68431
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect d
CVECVE-2026-68431
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 12 · 12:17 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2024-38620
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers. Since we no longer need to differentiate between AMP and Primary controller
CVECVE-2024-38620
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 20 · 08:15 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2025-1244
8.8/10 · Worth your timeNVDvuln
Summary
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
CVECVE-2025-1244
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 12 · 03:15 PM CST
ModifiedSun, Aug 23 · 06:16 PM CDT
CVE-2026-1784
8.8/10 · Worth your timeNVDvuln
Summary
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
CVECVE-2026-1784
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 02 · 09:16 AM CDT
ModifiedMon, Aug 24 · 07:16 AM CDT
CVE-2026-64280
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is deriv
CVECVE-2026-64280
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-64586
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain bus_reset work on device removal brcmf_fw_crashed() and the debugfs "reset" entry both schedule drvr->bus_reset, whose callback recovers drvr through container_of() and dereferences it. The removal path frees drvr (brcmf_free -> w
CVECVE-2026-64586
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 06 · 08:16 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-68198
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_d
CVECVE-2026-68198
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 10 · 01:20 PM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72045
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own
CVECVE-2026-72045
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72051
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the on
CVECVE-2026-72051
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72053
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the req
CVECVE-2026-72053
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72148
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation is not atomic,
CVECVE-2026-72148
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-72157
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(sk
CVECVE-2026-72157
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 06:21 AM CDT
ModifiedSun, Aug 23 · 01:16 PM CDT
CVE-2026-17107
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unre
CVECVE-2026-17107
SeverityHIGH
TypeUPDATED
PublishedFri, Jul 24 · 07:16 PM CDT
ModifiedMon, Aug 24 · 08:16 AM CDT
CVE-2026-49332
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated l
CVECVE-2026-49332
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 28 · 01:18 PM CDT
ModifiedMon, Aug 24 · 07:16 AM CDT
