Tue, May 26 · 02:16 PM CDTCVE-2026-7374
9.9/10 · Must read/watchNVDvuln
Summary
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container r
CVECVE-2026-7374
SeverityCRITICAL
TypeUPDATED
PublishedTue, May 26 · 02:16 PM CDT
ModifiedMon, Jul 27 · 02:16 AM CDT
CVE-2026-64216
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for
CVECVE-2026-64216
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jul 24 · 04:16 PM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64232
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." T
CVECVE-2026-64232
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jul 24 · 04:16 PM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64268
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks
CVECVE-2026-64268
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64303
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was already submitted and
CVECVE-2026-64303
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64355
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outsid
CVECVE-2026-64355
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64383
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, fl
CVECVE-2026-64383
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64384
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response
CVECVE-2026-64384
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64385
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response
CVECVE-2026-64385
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64386
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that respon
CVECVE-2026-64386
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64387
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, cleanup retains the previous buffer type and frees tha
CVECVE-2026-64387
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64391
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credential
CVECVE-2026-64391
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64397
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an
CVECVE-2026-64397
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64399
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check
CVECVE-2026-64399
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-48561
9.6/10 · Must read/watchNVDvuln
Summary
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
CVECVE-2026-48561
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 14 · 05:16 PM CDT
ModifiedSun, Jul 26 · 06:17 PM CDT
CVE-2026-64257
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However,
CVECVE-2026-64257
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64269
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from
CVECVE-2026-64269
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64319
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the
CVECVE-2026-64319
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64320
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then added to a small kzalloc'd buffer that hold
CVECVE-2026-64320
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64392
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker cr
CVECVE-2026-64392
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64393
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the current ksmbd worker c
CVECVE-2026-64393
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64206
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown can deadlock against the worker it is flus
CVECVE-2026-64206
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 20 · 05:18 PM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64255
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtrac
CVECVE-2026-64255
SeverityHIGH
TypeUPDATED
PublishedFri, Jul 24 · 04:16 PM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64280
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is deriv
CVECVE-2026-64280
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
CVE-2026-64313
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (r01.m_high < product.m_high) doesn't handle the case where r0
CVECVE-2026-64313
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 25 · 10:17 AM CDT
ModifiedMon, Jul 27 · 05:16 AM CDT
