Thu, Sep 10 · 10:17 PM CDTCVE-2026-79724
9.8/10 · Must read/watchNVDvuln
Summary
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
CVECVE-2026-79724
SeverityCRITICAL
TypeUPDATED
PublishedThu, Sep 10 · 10:17 PM CDT
ModifiedSat, Sep 12 · 04:16 PM CDT
CVE-2026-80926
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check()
CVECVE-2026-80926
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSun, Sep 13 · 07:16 AM CDT
CVE-2026-80976
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet, including nhoff and e
CVECVE-2026-80976
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80980
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two: u8 killed : 1; u8 fre
CVECVE-2026-80980
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80981
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:149
CVECVE-2026-80981
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80986
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max_recv_sge == 1 there is no shared v2 receive buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44 bytes past the start of the queue entry's in
CVECVE-2026-80986
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-81002
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom e
CVECVE-2026-81002
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89478
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until th
CVECVE-2026-89478
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89479
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference. A packet that matches no
CVECVE-2026-89479
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89482
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Commit 25e5cb780e62 ("nvme-tcp: fix possible crash in write_zeroes processing") established that blk_rq_payload_bytes() must not be read without first checking blk_rq_nr_phys_segment
CVECVE-2026-89482
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89485
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next f
CVECVE-2026-89485
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89492
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the
CVECVE-2026-89492
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89494
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation. num_locks and lockname_len are bounded only on the sending side, and the
CVECVE-2026-89494
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89495
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in a DLM domain can cor
CVECVE-2026-89495
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89448
9.3/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced
CVECVE-2026-89448
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80945
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later d
CVECVE-2026-80945
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-78569
8.8/10 · Worth your timeNVDvuln
Summary
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.
CVECVE-2026-78569
SeverityHIGH
TypeUPDATED
PublishedThu, Sep 10 · 10:16 PM CDT
ModifiedSat, Sep 12 · 04:16 PM CDT
CVE-2026-80935
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps onl
CVECVE-2026-80935
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80937
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le3
CVECVE-2026-80937
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:18 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-80989
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() therefo
CVECVE-2026-80989
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-84889
8.8/10 · Worth your timeNVDvuln
Summary
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
CVECVE-2026-84889
SeverityHIGH
TypeUPDATED
PublishedThu, Sep 10 · 10:17 PM CDT
ModifiedSat, Sep 12 · 04:16 PM CDT
CVE-2026-89445
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's
CVECVE-2026-89445
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89450
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 2
CVECVE-2026-89450
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89493
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i rf_records.rl_used); i++) { rec = &rb->rf_records.rl_recs[i]; ... rl_recs[] lives in a single me
CVECVE-2026-89493
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
CVE-2026-89513
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loop
CVECVE-2026-89513
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 11 · 08:19 PM CDT
ModifiedSun, Sep 13 · 07:17 AM CDT
