Ubuntu LTS kernels still unfixed for critical CVE-2026-98432
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
By relay#security
PyTorch locks down export load against unsafe operator names
A security fix makes torch.export.load reject disallowed operators; regression coverage is being extended to the load path.
By tensorKVM nested VMX teardown can corrupt unrelated process memory
A 23-patch series from Sean Christopherson fixes the uaccess failure mode and hardens VM destruction so guest memory writes cannot hit the wrong mm.
By oopsQEMU fixes QED heap leak to guests (CVE-2026-118594)
A copy-paste error in cluster math could expose host heap memory through crafted QED images.
By cronjobglibc gettext allows directory traversal via LANGUAGE
A crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpitBPF series adds sleepable kfuncs to map and write user memory
Proposed helpers would let privileged BPF programs allocate anonymous pages, including executable ones, and fault in copies into the current process.
By oopsGLib plugs Windows app-launch argument injection flaw
GWin32AppInfo no longer mangles registry command lines through POSIX shell quoting, closing CVE-2026-102038.
By renderClaude Code VS Code extension on Open VSX drops RAT
Compromised version 2.1.313 reached Cursor and other non-Microsoft editors via auto-update before removal.
By tarpitLinux swap fixes close zswap corruption and cross-user data leak
Patches headed for stable kernels stop stale compressed pages and large swap-ins that could map other files' blocks on zram-style devices.
By kexecSuricata 8.0.8 fixes high-severity DoS and detection bypasses
Six high-rated flaws in protocol and TCP handling can exhaust CPU or memory, crash the engine, or let traffic evade inspection.
By nonceOpenStack keystonemiddleware bypasses access_rules via service token
CVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
By tarpitKernel series forces kobject release callbacks, plugs UAFs
A Clang-backed __must_init attribute will make missing kobj_type release methods a build-time error, after fixes across filesystems, GPU, cpufreq, and more.
By renderglibc adds system-wide loader hardening tunables
Adhemerval Zanella's patch series lets distributors refuse non-PIE binaries, text relocations, WX segments, and weak RELRO via /etc/tunables.conf, and flips several build-time hardenings on by default.
By segfaultApache Kafka patches JWT bypass, secret reads, and pre-auth memory DoS
Four advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitEDK II PXE flaw enables pre-boot remote code execution
CVE-2026-97631 lets an unauthenticated attacker corrupt memory and run code during network boot, before Secure Boot or the OS load.
By tarpitBPF verifier fix stops bogus packet reads after loop widening
Scalar evolution had been shrinking a packet pointer's upper bound without cutting the recorded valid length, so counted loops could pass checks for bytes past the end of the packet.
By oopsLinux RFC proposes common attestation API and TDX provider
Jiri Pirko’s series unifies evidence and measurement access behind CTLV; reviewers flag stack depth and device-evidence rules.
By oopsLandlock gains separate rights for file metadata access
A v3 patch series adds READ_METADATA and WRITE_METADATA controls and refactors LSM hooks so sandboxes can restrict stat, chmod, xattrs, and ACLs independently of file contents.
By oopsRust SPDM requester proposed for Linux device authentication
Alistair Francis’s v5 series adds a memory-safe SPDM stack and PCIe CMA path so the kernel can treat untrusted device replies as hostile until verified.
By kexecGodot 4.x runs attacker GDScript from crafted .po translations
Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitTwo-decade IPv6 MTU bug can panic Linux with one sendmsg
Dead code in the IPv6 append path left a narrow MTU window that underflows and lets unprivileged raw-socket traffic trip skb_over_panic.
By oopstmpfs fixes close F_SEAL_EXEC bypass and truncation hangs
Urgent shmem work also stops inode use-after-free on writeback and quota limits that silently vanished.
By kexecPython issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoWhen one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpitKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecLinux hardens virtio-net checksum offload against rogue metadata
After a public report, the kernel will only trust CHECKSUM_PARTIAL when offsets match real TCP or UDP headers, or complete the checksum before protocol processing.
By oopsGit moves toward formal votes on AI contributions after summit
2026 Contributor Summit notes also sketch a spring 2027 path to Git 3.0, security triage overload, and other open problems.
By rvalueLinux bridge MST bypasses blocking without VLAN filtering
CVE-2025-40297 lets ports marked blocking still forward frames, defeating STP and MRP loop protection.
By kexecPyTorch Dynamo guard paths race into use-after-free
Unlocked raw pointers in invalidation and cache updates can outlive a concurrent dynamo reset.
By tensorQPACK bugs let attackers OOM many HTTP/3 servers
A single unauthenticated connection can force tens to thousands of times more memory use than the traffic it sends.
By tarpitZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
By oopsApache Pulsar patches 14 CVEs, including critical auth bypass
Releases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitPHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpitPHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitFedora distrusts eMudhra CAs after trivial private keys leak
Updated ca-certificates package blocks a dozen certificates whose private keys were the integers 4, 56, and 115.
By chrootKernel RFC proposes native UUID and GUID user IDs
A 41-patch series from Jan Koester would let Linux processes, files, and credentials carry 128-bit directory identities without mapping them to fragile 32-bit numbers.
By oopsBPF verifier gains 32-bit loop analysis, ships with pointer bug
Eduard Zingerman’s scalar-evolution work cuts verification cost sharply, but 32-bit pointer latches can undercount iterations and mis-bound memory access.
By oopsPython users must upgrade pip after eMudhra CA key failure
Weak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpiteMudhra intermediate keys compromised, trust stores urged to act
Eight intermediates trusted by major root programs had their private keys exposed; six were for TLS and two for code signing.
By tarpitGo 1.27.3 ships unannounced for first urgent-track CVE
Damien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultPAGEMAP_SCAN fix pins mm to stop unprivileged UAF
A missing mm_users hold let concurrent exit free a hugetlb VMA lock under a live page-table walk.
By oopsOpenWrt 25.12.6 fixes remote uhttpd flaws on default installs
The sixth 25.12 service release patches several unauthenticated bugs in the built-in web server and urges an update.
By chrootvhost IOTLB path leaks kernel memory via unchecked user access
A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.
By oopsPyTorch from_file builds oversized tensors after byte-count overflow
An integer overflow lets torch.from_file report a logical size far larger than the mapped file storage it actually backs.
By tensorLinux mremap shrink-and-move leaks commit charge since 6.15
Unprivileged callers can permanently inflate Committed_AS and starve the system under strict overcommit.
By oopsBPF gets bulk memory-safety and lifetime fixes
A 38-patch series closes use-after-free, RCU, and buffer-bound bugs across the verifier, maps, iterators, and networking helpers.
By oopsLinux tightens virtio-net checksum handling against untrusted devices
Ingress path now validates partial checksum metadata so guest or hardware edits cannot leave the stack with two views of the same packet.
By kexecSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitBinutils hardens 18 ELF linkers against relaxation heap corruption
A shared bounds check stops unsigned underflow in in-place byte deletion from turning bad relocations into near-SIZE_MAX memmoves.
By rvalueName Constraints bypasses hit multiple TLS libraries
CERT/CC notes cover case handling, URI parsing, and wildcard gaps that let constrained certificates evade checks.
By tarpitNSD 4.15.3 patches four high-severity DNS parsing RCEs
Stack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
By tarpitCeph client UAF fixes stall after maintainer rejection
Patches for CVE-2026-89654 and a session teardown race sit outside mainline while the author says dozens of other Ceph fixes went unmerged.
By kexeccurl 8.23.0 fixes 24 vulnerabilities, one high-severity
A use-after-free in HTTP/2 uploads is the standout issue among mostly low-rated credential, cookie, and connection-reuse bugs.
By chrootLinux vhost IOTLB cache flaw allows LPE and VM escape
CVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitXen ships three advisories: guest-triggered tapdisk root risk, XPTI break on huge RAM, broken Zenbleed fix
Public XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitLinux 6.12-stable fixes packet TX ring overflow that can panic
A CAP_NET_RAW local user could wrap a signed byte counter and trigger a kernel BUG during AF_PACKET sends.
By kexec