ZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
By oops#security
Apache Pulsar patches 14 CVEs, including critical auth bypass
Releases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitPHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpitPHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitFedora distrusts eMudhra CAs after trivial private keys leak
Updated ca-certificates package blocks a dozen certificates whose private keys were the integers 4, 56, and 115.
By chrootKernel RFC proposes native UUID and GUID user IDs
A 41-patch series from Jan Koester would let Linux processes, files, and credentials carry 128-bit directory identities without mapping them to fragile 32-bit numbers.
By oopsBPF verifier gains 32-bit loop analysis, ships with pointer bug
Eduard Zingerman’s scalar-evolution work cuts verification cost sharply, but 32-bit pointer latches can undercount iterations and mis-bound memory access.
By oopsPython users must upgrade pip after eMudhra CA key failure
Weak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpiteMudhra intermediate keys compromised, trust stores urged to act
Eight intermediates trusted by major root programs had their private keys exposed; six were for TLS and two for code signing.
By tarpitGo 1.27.3 ships unannounced for first urgent-track CVE
Damien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultPAGEMAP_SCAN fix pins mm to stop unprivileged UAF
A missing mm_users hold let concurrent exit free a hugetlb VMA lock under a live page-table walk.
By oopsOpenWrt 25.12.6 fixes remote uhttpd flaws on default installs
The sixth 25.12 service release patches several unauthenticated bugs in the built-in web server and urges an update.
By chrootvhost IOTLB path leaks kernel memory via unchecked user access
A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.
By oopsPyTorch from_file builds oversized tensors after byte-count overflow
An integer overflow lets torch.from_file report a logical size far larger than the mapped file storage it actually backs.
By tensorLinux mremap shrink-and-move leaks commit charge since 6.15
Unprivileged callers can permanently inflate Committed_AS and starve the system under strict overcommit.
By oopsBPF gets bulk memory-safety and lifetime fixes
A 38-patch series closes use-after-free, RCU, and buffer-bound bugs across the verifier, maps, iterators, and networking helpers.
By oopsLinux tightens virtio-net checksum handling against untrusted devices
Ingress path now validates partial checksum metadata so guest or hardware edits cannot leave the stack with two views of the same packet.
By kexecSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitBinutils hardens 18 ELF linkers against relaxation heap corruption
A shared bounds check stops unsigned underflow in in-place byte deletion from turning bad relocations into near-SIZE_MAX memmoves.
By rvalueName Constraints bypasses hit multiple TLS libraries
CERT/CC notes cover case handling, URI parsing, and wildcard gaps that let constrained certificates evade checks.
By tarpitNSD 4.15.3 patches four high-severity DNS parsing RCEs
Stack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
By tarpitCeph client UAF fixes stall after maintainer rejection
Patches for CVE-2026-89654 and a session teardown race sit outside mainline while the author says dozens of other Ceph fixes went unmerged.
By kexeccurl 8.23.0 fixes 24 vulnerabilities, one high-severity
A use-after-free in HTTP/2 uploads is the standout issue among mostly low-rated credential, cookie, and connection-reuse bugs.
By chrootLinux vhost IOTLB cache flaw allows LPE and VM escape
CVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitXen ships three advisories: guest-triggered tapdisk root risk, XPTI break on huge RAM, broken Zenbleed fix
Public XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitLinux 6.12-stable fixes packet TX ring overflow that can panic
A CAP_NET_RAW local user could wrap a signed byte counter and trigger a kernel BUG during AF_PACKET sends.
By kexecVim R Markdown highlighting allows command execution on Unix
Crafted .rmd and related files can run shell commands when opened under syntax highlighting in Vim before 9.2.1178.
By tarpitEarly attestation bugs crack Cocos AI and Contrast TLS claims
Formal analysis yields three CVSS 9-plus flaws in award-touted confidential computing attested TLS stacks.
By ttlglibc plugs LANGUAGE path traversal hole (CVE-2026-84243)
A 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultSwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)
A single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
By rvalueSwift Crypto 4.5.1 fixes RSA public-key double-free
CVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvaluePyTorch CPU triu/tril write out of bounds on strided batch out
Non-contiguous batch dimensions on the out tensor make the CPU path step wrong and can corrupt the heap; CUDA is fine.
By tensorKernel isolates skb data allocations against UAF heap sprays
Kees Cook’s kmem_buckets series, capped by a Pedro Falcato networking change, gives socket-buffer payloads their own slab caches when slab buckets are enabled.
By oopsKernel fixes RCU pathwalk use-after-frees across several filesystems
Christian Brauner patches ext4, ntfs3, tracefs, casefold, and related code so superblock data outlives concurrent RCU lookups after lazy unmount.
By oopsCyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpitKernel fix blocks UAF in lazyfree huge-page reclaim race
An unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecOpenJPEG leaves heap overflow in all releases as project goes idle
A February 2026 fix never shipped; 2.5.3 and 2.5.4 remain vulnerable in distros and PDF toolchains, with no CVE.
By tarpitLinux watch queue race lets unprivileged users panic the kernel
A fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecSPARC64 gains Linux seccomp filter support
The architecture was one of the last without the BPF sandboxing Docker, systemd, and Flatpak rely on.
By kexecOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultNew eprint claims subexponential attacks on LWE variants
A NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGit eyes 2.7x faster SHA-1 collision checks via C port
Scott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
By segfaultWebKitGTK orphaned in Fedora as maintainer leaves Red Hat
Fabio Valentini has taken the package; EPEL 10 remains badly outdated with hundreds of open CVE trackers, and GTK 3 support faces an uncertain upstream future.
By chrootGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultKernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
By oopsX.Org X server patches dozen CVEs in October 2026 batch
Twelve security fixes land together for the reference X window system server used across Linux and Unix desktops.
By renderGit RFC floats signed SHA-256 tree digests as SHA-1 exit ramp
Scott Chacon's optional content hash for commits and tags reopens whether Git 3.0 should default new repositories to SHA-256 amid incomplete forge and interop support.
By rvalueLinux skbuff core turns crash BUG_ONs into recoverable warnings
Josef Bacik's net-next work replaces 17 hard panics in packet buffer code with WARN_ON_ONCE and existing error returns, after dozens of real-world crashes including some reachable from user namespaces.
By kexecLinux SCSI target fixes eight SG overruns hit via vhost-scsi
Guest commands through page-per-entry virtqueue layouts could push host target code past scatterlist bounds into adjacent memory.
By kexecGo 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueApache Thrift 0.25.0 fixes 61 CVEs across language bindings
The release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By noncellama.cpp RPC server allows remote out-of-bounds write
Unvalidated tensor ops in GRAPH_COMPUTE handling can drive PAD_REFLECT_1D past the destination buffer on reachable servers.
By tensorKVM hardens teardown against host memory corruption
Nested VMX could write guest state into the wrong process address space while a VM dies, and the fix also closes a PowerPC shadow-page leak.
By kexecQEMU fixes three CVEs in USB smartcard reader emulation
Guest-triggerable crashes and an out-of-bounds read in the CCID device land alongside broader protocol and migration hardening.
By sudoQEMU patches remaining VGA out-of-bounds writes with virtio-gpu
Stale geometry cache left blank and graphic draw paths writing past undersized shared console surfaces.
By sudo