LINQPad Pro editions before version 5.52.01 contain an unsafe deserialization vulnerability in the LINQPad.AutoRefManager::PopulateFromCache() method. This flaw allows an attacker with limited privileges to execute arbitrary code. Public exploit code is available via Metasploit. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity.
NAVER MYBOX Explorer for Windows versions before 3.0.11.160 contain a vulnerability that allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by manipulating the registry due to improper privilege checks. This vulnerability has a high severity rating with a CVSS score of 7.8.
CVE-2026-43277 is a vulnerability in the Linux kernel's APEI/GHES subsystem where improper bounds checking of CPER records can lead to a kernel crash (OOPS). The issue arises because the kernel checks record size against a maximum limit but allocates memory based on a smaller size from the firmware, allowing a malicious or faulty firmware to trigger an out-of-bounds access. This can cause a kernel paging fault and system instability.
A vulnerability in the Linux kernel's RDMA ionic driver was fixed to prevent a potential NULL pointer dereference in the ionic_query_port() function. The issue arose because the function called ib_device_get_netdev() without verifying if the returned pointer was NULL, which could lead to a kernel crash. The fix involves checking the return value and returning an error code if the pointer is NULL.
A medium severity vulnerability in the Linux kernel's fsl-imx8mq-usb PHY driver was fixed by adding a missing platform_set_drvdata() call. This data is necessary for proper cleanup during driver removal. The flaw does not impact confidentiality or integrity but can cause availability issues.
CVE-2026-43260 is a vulnerability in the Linux kernel's bnxt_en driver related to improper handling of RSS context deletion. The issue arises because the driver conditionally deletes the RSS context VNIC in firmware only when the network interface is running, which can cause resource leaks when the interface is down. This leads to failures in creating new VNICs on subsequent interface opens, resulting in loss of active RSS contexts.
CVE-2026-43266 is a vulnerability in the Linux kernel's EFI/CPER handling for ARM processors. The flaw involves improper validation of the section_length field in the ARM processor CPER record, allowing the kernel to trust an excessively large section length. This can cause the kernel to read and dump data beyond the intended firmware memory area. The issue is fixed by adding logic to prevent reading past the buffer when ERR_INFO_NUM is too large, resulting in an error message instead of an invalid dump.
CVE-2026-43261 addresses a vulnerability in the Linux kernel related to the arm64 architecture. The TSV110 processor is susceptible to the Spectre-BHB (Branch History Buffer) side-channel attack. The Linux kernel has been updated to include software mitigation by adding the TSV110 processor's MIDR to the mitigation list.
CVE-2026-43265 is a medium-severity vulnerability in the Linux kernel's KVM x86 virtualization component. It involves improper handling of the -EBUSY error when checking nested events from the vcpu_block() function. This can lead to spurious userspace exits with KVM_EXIT_UNKNOWN and potentially cause the virtual machine to crash or become unstable. The issue arises because userspace can place a vCPU into an impossible blocking state with injected events, which the kernel did not properly handle. A fix has been implemented to ignore the -EBUSY error in this context to improve VM stability.
A vulnerability in the Linux kernel's rtw89 WiFi driver was identified where the beacon interval could be zero, leading to a division by zero error during beacon tracking. This issue was found during fuzz testing and fixed by setting a default beacon interval value of 100 TU when zero is detected. The flaw could cause a denial of service by impacting system stability.
CVE-2026-43276 is a use-after-free vulnerability in the Linux kernel's mana network driver. It occurs due to a double destruction of a workqueue during the PCI service rescan path, which can lead to system crashes. The issue arises when mana_gd_cleanup() destroys a workqueue and is called again without proper null checks, causing a second destruction attempt on an already freed resource.
A vulnerability in the Linux kernel's gfs2 filesystem component related to the fiemap operation could cause a page fault due to recursive glock acquisition when accessing memory-mapped fiemap buffers. This issue has been fixed by disabling page faults during iomap_fiemap() and manually faulting in the buffer if needed.
A memory leak vulnerability was fixed in the Linux kernel's media subsystem, specifically in the radio-keene driver. The issue occurred in the usb_keene_probe() function where the v4l2 control handler was initialized but not freed if certain registration functions failed, causing memory to leak. The fix adds a call to v4l2_ctrl_handler_free() in the error path to properly release allocated resources.
A reference leak vulnerability was identified and fixed in the Linux kernel's media subsystem, specifically in the mtk-mdp driver. The issue involved the mtk_mdp_remove() function failing to release a platform device reference acquired during mtk_mdp_probe(), potentially leading to resource leakage. The fix adds a call to platform_device_put() to properly decrement the reference count.
A vulnerability in the Linux kernel's Ceph filesystem implementation was fixed by supplying the correct snapshot context in the ceph_zero_partial_object() function. The flaw caused data inconsistencies in snapshots due to missing snapshot context during OSD write operations. This could lead to corrupted or inconsistent snapshot data when using Ceph snapshots.
CVE-2026-43275 is a medium severity vulnerability in the Linux kernel's UFS core driver related to runtime power management (RPM). The flaw involves a race condition during system suspend when the RPM level is zero, where exception event handling work was not properly flushed. This could lead to the driver accessing hardware after the system entered deep power-down, causing a system crash. The issue is resolved by explicitly flushing the exception handling work and disabling auto background operations before suspend proceeds.
CVE-2026-43268 is a vulnerability in the Linux kernel's hfsplus filesystem driver where special inodes are incorrectly treated as regular files. This issue was addressed by ensuring that special inodes are represented with the S_IFREG type to comply with inode type requirements in the kernel.
CVE-2026-43269 is a medium severity vulnerability in the Linux kernel's drm/atmel-hlcdc driver involving a memory leak caused by improper cleanup in the atomic_destroy_state callback. The issue results in some drm_crtc_commit objects not being freed, leading to increased slab memory usage over time during graphics application usage. The fix involves using the __drm_atomic_helper_plane_destroy_state() function to properly release all no longer needed objects.
CVE-2026-43229 is a medium severity vulnerability in the Linux kernel's chips-media wave5 driver. It involves an improper device cleanup order that can cause kernel panic due to hardware register access after the device has been powered down. This occurs because video device unregistration was done too late, allowing a worker thread to access powered-off hardware registers, triggering a synchronous external abort and kernel panic during encoding operations.
CVE-2026-43264 is a medium severity vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem related to device tree display timing parsing. A reference count leak occurs in the of_get_display_timings() function due to improper cleanup on error paths, which can lead to resource exhaustion. The issue is fixed by correcting the error handling to properly decrement the reference count before cleanup.