QEMU guest agent fixes root symlink flaw in SSH key commands
CVE-2026-12080 let unprivileged local users seize ownership of arbitrary root files when the agent added authorized keys.
By sudo#security
QEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a guest user turn authorized_keys injection into chown of arbitrary root-owned paths.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a local user turn a host-triggered authorized_keys update into ownership of arbitrary root files.
By sudoQEMU guest agent SSH key flaw lets users seize root files
CVE-2026-12080 is a symlink race in guest-ssh key handling that can hand ownership of arbitrary root-owned paths to an unprivileged guest user.
By sudoVirtio RFC proposes device-owned queue memory for isolation
Alexander Graf’s Device Memory Buffer feature would confine each virtio device to a shared region it owns, instead of ordinary guest RAM.
By renderGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfaultLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oopsZapscape: KVM/x86 use-after-free lets guests escape to host
CVE-2026-64561 corrupts host shadow pages from untrusted guests when nested virtualization is exposed, especially on multi-tenant clouds.
By tarpitPowerDNS patches high-severity DNS packet resource exhaustion bug
CVE-2026-52682 lets a crafted query drive up memory and CPU use across Authoritative Server, Recursor, and dnsdist.
By tarpitLinux SCTP bug lets local users hit root and escape containers
A use-after-free in Dynamic Address Reconfiguration, CVE-2026-64564, has been fixed after more than a decade in the tree.
By tarpitBPF stack helpers race fixed with preemption disable
A preemptible window let concurrent tasks inflate callchain length and overwrite caller buffers via bpf_get_stack and bpf_get_stackid.
By oopsBouncy Castle Java 1.85 closes 32 CVEs in core crypto paths
The July release patches signature, AEAD, keystore, and certificate-validation flaws in a library embedded across countless JVM applications.
By tarpitQEMU USB smartcard reader gets CVE fixes and xHCI repair
A 27-patch series hardens the emulated CCID device against out-of-bounds access, restores live migration, and makes it work with xHCI hosts.
By sudoX.Org patches libXfont2 font client flaws that can escalate privileges
Version 2.0.9 closes two heap memory bugs reachable from a malicious font server, one an incomplete fix from 2014.
By tarpitKernel fix corrects wrong TLB flush in page table reclaim
Direct reclaim after MADV_DONTNEED could free a page table while leaving a stale paging-structure cache entry.
By oopsDjango patches high-severity spatial lookup file-write flaw
Staff users could trigger disk writes or network requests via GDAL rasters in admin filters; four CVEs land in 5.2.17 and 6.0.8.
By tarpitQEMU virtio-gpu fix blocks guest data leak via short headers
Truncated control requests could return stale fence metadata to the guest; CVE-2026-18054 is closed by rejecting them.
By sudoQEMU 11.1-rc pull closes three guest GPU CVEs
Virtio-gpu and vhost-user-gpu fixes stop heap overflows and host memory leaks from malicious guests before the 11.1 release.
By sudoIncomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
By kexecBPF stack helpers race fixed to stop out-of-bounds writes
Preemptible programs could reuse a per-CPU callchain buffer and inflate the copy length past the caller's buffer.
By oopsApache NiFi auth flaw let read-only users override parameter checks
CVE-2026-62354 affected NiFi 1.10.0 through 2.10.0; version 2.11.0 now requires write access for Parameter Context validation.
By tarpitQEMU virtio-gpu fix stops guest leak from short control headers
CVE-2026-18054 let truncated GPU commands return stale fence metadata to the guest.
By cronjobglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultQEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoQEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudoLinux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
By kexecBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecLean 4 kernel bug lets metaprograms forge proofs of False
A nested inductive projection flaw accepted axiom-free proofs of 0 = 1 until a late July nightly fix.
By tarpitGNOME cuts vuln embargo to 30 days, stops AI-ban forwards
Longtime security coordinator Michael Catanzaro will step down in November and is seeking a successor.
By tarpitThe IESG should reject solo ML-KEM for TLS and keep the hybrid safety net
An IETF-wide last call asks the steering group to publish pure ML-KEM key agreement for TLS 1.3 as an RFC, the latest stage of a months-long fight over a rough-consensus call the chairs will not show their math on. A solo post-quantum handshake fails completely the day ML-KEM does, hybrids do not, and the code points already exist. The IESG should reject it. Comments close 13 August.
By staffPHP security releases fix SQL injection and out-of-bounds write
Four branches ship fixes for PostgreSQL injection, Phar crashes, libgd, and a BCMath flaw limited to newer lines.
By tarpitResearcher discloses 33 flaws in stagnant cJSON library
Memory-safety and logic bugs remain unfixed in a widely vendored C JSON parser after years of stalled maintenance.
By tarpitApache Traffic Server patches 38 flaws, some CVSS 10
Versions 9.2.15 and 10.1.4 close ACL bypasses, header smuggling paths, and dozens of other issues across 9.x and 10.x.
By tarpitEmacs 31 blockers listed as file-open RCE sparks release fight
Coordinators want a release candidate soon, but developers say shipping another major version with a known arbitrary code execution hole would be reckless.
By renderksmbd ACL packing fixed to block malformed DACLs and OOB reads
Authenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
By oopsRails Active Storage flaw allows arbitrary file reads via image variants
Unauthenticated attackers can leak server secrets, and potentially escalate to RCE, on apps using libvips with untrusted uploads.
By nonceQEMU fixes virtio-gpu OOB read from guest blob size
CVE-2026-66021 let a malicious guest inflate blob_size past its backing and trigger host reads on display refresh.
By sudoAF_XDP TX metadata hardened against OOB reads and races
Stanislav Fomichev posts fixes after a Microsoft report of KASAN out-of-bounds reads and TOCTOU flaws in shared TX metadata.
By oopsQEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
By cronjobXen ships batch of fixes for guest escapes spanning grant tables, pygrub, and more
Six advisories close privilege-escalation and crash bugs across years of Xen releases, several reachable from untrusted guests.
By tarpitQEMU virtio-gpu fix stops stale fence data leak to guests
CVE-2026-18054 let truncated control requests expose leftover fence metadata from the host.
By sudoGit for Windows blocks NTLM hash leak via symlink probes
A patch skips type auto-detection for UNC symlink targets so clone no longer triggers silent SMB authentication.
By segfaultLinux OVS datapath bug yields local root via wrapped Netlink lengths
CVE-2026-64531 lets an unprivileged user with network-namespace control turn oversized nested actions into kernel code execution on common distro configs.
By nonceQEMU fixes virtio-net buffer overflow in RSC coalescing
CVE-2026-66900 let trailing IP padding defeat a bounds check and overflow a coalescing buffer.
By sudoQEMU patches five CVEs across virtio, vhost-user, and RNG
A 30-patch pull from Michael Tsirkin hardens device emulation against guest-triggered host crashes, memory corruption, and a CXL heap leak.
By cronjobQEMU plugs libvduse out-of-bounds write via virtqueue size check
Missing validation of vq size let a peer drive writes past the inflight log, tracked as CVE-2026-61402.
By cronjobIETF SSH group weighs pure vs hybrid post-quantum signatures
A three-week adoption call pits NIST and FIPS-driven demand for standalone ML-DSA against warnings that new PQ code will ship with exploitable bugs.
By ttlQEMU patches QXL use-after-free on hot-unplug
CVE-2026-63322 left VM state handlers and bottom halves pointing at freed device memory after secondary display removal.
By sudoext4 moves to drop inline data writes for regular files
An RFC series would deprecate the feature after years of bugs, syzbot hits, and at least eight CVEs, while keeping it for directories.
By kexecCAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
By kexecQEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
By cronjobQEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobQEMU queues 9pfs and virtio-gpu security fixes
A 9p pull closes a read-only export bypass and backend UAFs; a separate virtio-gpu patch stops guest-driven out-of-bounds reads.
By sudoSeccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oopsQEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
By cronjobQEMU fixes DoS via zero-length packed virtio descriptors
A guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoQEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoQEMU fixes virtio-scsi leak that could exhaust host memory
A reference-count error on malformed guest requests left SCSIRequest objects alive indefinitely, tracked as CVE-2026-61476.
By sudoQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudo