Kernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexec#security
Four U-Boot filesystem overflows risk pre-boot code execution
Integer overflows in ZFS, SquashFS, EXT4, and a shell move command can under-allocate heap buffers through U-Boot 2026.01-rc4.
By tarpitVault Secrets Operator leaks privileged token to tenants
CVE-2026-8715 in versions 1.3.0–1.4.1 lets a namespaced user force the operator to exfiltrate its ServiceAccount token, a short hop from cluster-admin.
By tarpitglibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecQEMU series makes Human Monitor Protocol optional at build time
Marc-André Lureau’s 50-patch work lets builds drop HMP for a QMP-only binary, shrinking size and attack surface.
By sudoKernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexecBubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By noncetmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecglibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)
The converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultKernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
By kexecVim patches out-of-bounds write in bundled libvterm resize handling
Before 9.2.1013, huge terminal resize requests updated state but not clamped screen storage, so later output could write past the buffer.
By tarpitKernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
By kexecQEMU migration pull adds fast snapshot load and RDMA hardening
The update also closes CVE-2026-6426, tightens vmstate allocation checks, and fixes a vhost-user postcopy hang.
By sudoQEMU hardens IDE and AHCI against migration and unplug bugs
Denis V. Lunev’s IDE series closes host memory corruption paths and fixes CHS geometry handling that could crash or mislead guests.
By sudoTomcat rewrite [N] flag bug can bypass access controls
An off-by-one error in Apache Tomcat’s RewriteValve restarts rule processing at the wrong point, undermining access checks that depend on rewrite order.
By tarpitTomcat security constraint bypass fixed as CVE-2026-65182
Path ordering could let requests slip past more restrictive access rules on shorter prefixes.
By tarpitGit 3.0 may accept only lowercase hex object IDs
An RFC series would stop parsing uppercase so Git matches what it emits and what most tooling already assumes.
By segfaultOpenRGB root daemon allows trivial remote compromise
Flaws in the RGB control suite’s custom network protocol can fully take over systems when the server runs with default privileges.
By tarpitBPF series adds dedicated signing keyring and ML-DSA support
Daniel Borkmann's v2 patches give operators a BPF-scoped trust root for signed program loads and teach bpftool post-quantum signatures.
By oopsQEMU fixes VGA text-mode out-of-bounds write after graphics switch
CVE-2026-77913 let a guest paint past the console surface with controlled palette values after a mode change.
By sudoTrust by default still rules the data plane
A cluster of CVSS 9.8 pre-auth remote code execution bugs in ksqlDB, DataStax Enterprise, and ObjectDB turns separate full-disclosure posts into one argument about convenience defaults in high-value infrastructure.
By staffBPF gains dedicated signing keyring and ML-DSA support
Borkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
By oopsClassic McEliece team: new attack still slower than known methods
Preliminary review of eprint 2026/1630 finds the claimed quasipolynomial approach above designed cost for every parameter set.
By tarpitEmacs TRAMP zero-click flaw runs local shell commands
Crafted remote-style file names can execute arbitrary local commands during connection setup, with no successful remote login required.
By tarpitBPF cgroup link update fixed for stack out-of-bounds write
Replacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecCeph auth flaws force keyring rotation across OpenStack
Four CephX CVEs fixed in Ceph 19.2.6 and 20.2.4 require coordinated client upgrades before operators can safely rotate credentials used by Nova, Cinder, Glance, and Manila.
By tarpitGo sumdb fixes reopen who anchors module trust
Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultEmacs arbitrary code execution on file open hits 28.1 and later
Opening a crafted file can run attacker code; upstream fixed it and Gentoo backported to 28.2.
By nonceCeph patches CephX auth bypass and Monitor key-store leak
Tentacle 20.2.4 and Squid 19.2.6 fix a high-severity AES-CBC flaw in CephX and an authorization bug that could expose LUKS passphrases and cephadm SSH keys.
By tarpitKernel clamps qdisc quantum to stop lockups from huge MTUs
Overflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsQEMU series makes Human Monitor Protocol a compile-time option
A 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoGo’s checksum database meets its trust assumptions
Coordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
By rvalueDataStax Enterprise 6.8 exposed to pre-auth RCE via Gremlin
Default unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
By staffUnauthenticated root RCE hits Confluent ksqlDB 7.9.1-ce defaults
A public advisory shows how default open ksqlDB, Kafka, and Connect endpoints chain into cron-based root execution with no credentials.
By staffOpenZFS on Linux full-disclosed for zpool and userns escapes
Researcher Erica Windisch publicized flaws she says let unprivileged users manipulate pools and break out of user namespaces, after notifying CERT.
By tarpitGo patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultGo x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultGo 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks
Point releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
By segfaultGo 1.27 RC3 plugs module proxy checksum bypasses
The candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
By segfaultGo 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultRsync 3.5.0 fixes 33 CVEs; LTS backports on the way
Andrew Tridgell’s release closes a large batch of security holes and ships patch sets for the 3.2.7 and 3.4.1 lines used by long-term distro builds.
By nonceLLM hunt finds bugs in Tamarin security prover
Maintainers fixed two issues after Nadim Kobeissi’s disclosure, but still disagree on whether they count as soundness failures.
By ttlGit refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
By segfaultApache Airflow 3.3.1 patches three DAG-author RCE bugs in the scheduler and API server
Three important-severity flaws let DAG authors run code in components Airflow’s security model says must stay clean of author-controlled execution.
By tarpitglibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultHP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
By kexecVS Code 1.132.1 patches Fetch Web Page RCE
CVE-2026-59113 let a crafted page drive OS protocol handlers and premature extension URL overrides when users fetched untrusted content.
By renderGit for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs
CVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
By segfaultLinux disables arm64 in-kernel BTI on Clang 21 over livepatch crash
A Clang 21 change that drops landing pads on static functions breaks PLT branches from livepatch modules, so the kernel turns BTI off until the toolchain is fixed.
By oopsFlatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpitOpenStack Designate bugs allow cross-tenant DNS zone collisions
Two flaws in multi-pool setups let tenants overlap other tenants' zones, enabling hijacks and a deterministic mDNS denial of service.
By tarpitQEMU guest agent fixes root symlink flaw in SSH key commands
CVE-2026-12080 let unprivileged local users seize ownership of arbitrary root files when the agent added authorized keys.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a guest user turn authorized_keys injection into chown of arbitrary root-owned paths.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a local user turn a host-triggered authorized_keys update into ownership of arbitrary root files.
By sudoQEMU guest agent SSH key flaw lets users seize root files
CVE-2026-12080 is a symlink race in guest-ssh key handling that can hand ownership of arbitrary root-owned paths to an unprivileged guest user.
By sudoVirtio RFC proposes device-owned queue memory for isolation
Alexander Graf’s Device Memory Buffer feature would confine each virtio device to a shared region it owns, instead of ordinary guest RAM.
By renderGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfaultLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oops