KVM escape, SCTP UAF, PowerDNS DoS, and GNOME security shifts

Public disclosures covered guest-to-host escapes and local privilege escalations in the Linux kernel, resource exhaustion flaws in PowerDNS, and multiple issues in Apache CXF. GNOME adjusted its security tracking practices while NIST sought feedback on HQC-KEM key formats for an upcoming FIPS draft.

KVM/x86 shadow MMU guest-to-host escape

A use-after-free vulnerability tracked as CVE-2026-64561, known as Zapscape, was disclosed in the KVM/x86 shadow MMU. The flaw permits a guest to escape to the host. Operators of KVM-based virtualization stacks should assess exposure and apply available fixes promptly.

PowerDNS resource exhaustion via crafted DNS packets

PowerDNS issued Security Advisory 2026-11 covering the Authoritative Server, Recursor, and dnsdist. A crafted DNS packet can trigger increased memory and CPU consumption under CVE-2026-52682. Deployments handling untrusted DNS traffic need the released patches to limit denial-of-service risk.

Linux SCTP ASCONF use-after-free with container escape

CVE-2026-64564 describes a use-after-free in the Linux SCTP ASCONF transport path. The issue enables local privilege escalation and container escape. Discussion on oss-security examined mitigations for affected kernel configurations.

GNOME shortens embargo and alters report handling

GNOME reduced its security embargo period to 30 days and stopped forwarding reports to projects that ban AI tools. The project also lost its security coordinator amid the policy changes. The shift affects how vulnerabilities in GNOME components reach downstream maintainers.

NIST proposes seed-only key format for HQC-KEM

NIST outlined a seed-only private key format for HQC-KEM in the forthcoming FIPS 207 draft. The approach differs from the dual formats used by ML-KEM and responds to interoperability feedback. Implementers of post-quantum cryptography should track the draft for format alignment.

Apache CXF attachment header denial of service

Apache CXF released a fix for CVE-2026-64958, a moderate denial-of-service issue involving message header attachments. The problem remained after an incomplete earlier patch. Users of CXF message processing should update to close the remaining vector.

Apache CXF JMS ObjectMessage deserialization

CVE-2026-66909 covers unsafe deserialization of inbound JMS ObjectMessage in Apache CXF. The flaw can lead to denial of service or remote code execution. Environments using the JMS transport require the advisory updates.

Apache CXF XXE in WSDL and XSD imports

Apache CXF addressed CVE-2026-65432, an XXE vulnerability in WSDL and XSD import parsing via WSDL4J. The issue surfaced after earlier top-level hardening. Services that process external WSDL definitions need the corrected handling.