A race condition vulnerability in the CustomTabs component of Google Chrome on Android versions prior to 155.0.8059.39 allows a local attacker to bypass the web origin policy via a co-installed app. This vulnerability has a medium severity rating and impacts confidentiality and integrity without affecting availability.
A missing authorization vulnerability in the FullScreen feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability requires user interaction (social engineering) and has a high impact on confidentiality, integrity, and availability.
An open redirect vulnerability exists in the AppManifest component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by leveraging social engineering with a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 6.1.
A vulnerability in Google Chrome prior to version 155.0.8059.39 involves incorrect authorization in the PermissionElement component. This flaw could allow a remote attacker to bypass the web origin policy by using a crafted HTML page. The issue is rated medium severity with a CVSS score of 6.5.
A medium severity vulnerability (CVE-2026-106397) exists in Google Chrome on iOS versions prior to 155.0.8059.39. It involves incorrect authorization in the mobile version of Chrome that allows a remote attacker, through social engineering and a crafted HTML page, to bypass system access restrictions.
A vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via crafted Chrome extensions using social engineering techniques. The issue is due to incorrect authorization in USB handling. The vulnerability has a medium severity rating with a CVSS score of 6.5.
This security update addresses multiple vulnerabilities in the jackson-annotations, jackson-core, and jackson-databind libraries. The issues include bypasses of number length constraints in asynchronous parsers, unsafe deserialization of java.nio.file.Path URIs, unbounded cache growth, denial of service via unbounded string builder growth, and unsafe polymorphic deserialization allowing arbitrary Comparable types. The update to version 2.18.11 includes fixes that enforce length limits, restrict URI schemes, optimize parsing functions, and prevent unbounded resource consumption.
A use-after-free vulnerability in the Linux kernel's drm/msm component was resolved by changing the freeing method of scheduler-containing objects to use kfree_rcu() instead of kfree(). This fixes an issue where a finished fence exported to userspace could reference freed memory, leading to a kernel slab-use-after-free read. The vulnerability affects specific Linux kernel versions used in various Ubuntu distributions.
A vulnerability in the Linux kernel's hwmon driver for w83791d devices was resolved. The issue involved the fan/pwm 4-5 sysfs group not being properly removed during driver unbind, leaving behind sysfs files that access freed driver data. This could lead to use-after-free conditions. The flaw was found by manual code inspection and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's IB/hfi1 driver related to incorrect handling of the PIO_CRED credit-return mmap in hfi1_file_mmap() has been resolved. The issue involves incorrect pointer arithmetic and improper use of the DMA API, causing user space to receive the wrong credit-return page. This leads to kernel crashes (Oops) and send PIO operations stalling indefinitely. The flaw affects specific Linux kernel versions and was tested on hardware using Intel IOMMU and Omni-Path 100. The vulnerability has a CVSS score of 7.1, indicating medium severity.
A vulnerability in the Linux kernel affects MIPS I6500 CPU cores due to improper ordering guarantees in load-linked/store-conditional (lld/scd) instructions. This can cause kernel paging faults and system crashes when the CPU reorders these instructions, violating assumptions about atomic operations. The issue has been resolved by injecting synchronization instructions around the lld/scd loops using existing infrastructure. The vulnerability impacts specific Linux kernel versions used in various Ubuntu LTS releases.
A use-after-free vulnerability in the Linux kernel's xfrm_input() function was resolved. The issue occurs because the function stores the current xfrm_state in the skb secpath but some input paths reset the secpath before xfrm_input() finishes dereferencing the state, leading to potential dereferencing of freed memory. This affects certain receive callback users such as VTI and XFRM interfaces. The fix involves saving the state protocol on the stack while the state is still valid to avoid post-reset dereferences.
A use-after-free vulnerability in the Linux kernel's xfrm subsystem was resolved by changing the deletion method for state_cache and state_cache_input lists to prevent double deletion and memory corruption. This fix prevents write and read use-after-free conditions caused by improper list handling.
A use-after-free vulnerability in the Linux kernel's lan743x network driver was fixed. The flaw occurs in lan743x_rx_process_buffer() when handling multi-buffer receive packets, leading to a write after free of skb fragment metadata. This can happen after a live MTU increase when old buffer sizes persist. The issue was confirmed by a KUnit test and resolved by setting ip_summed on the surviving head skb instead of the freed fragment. The fix was applied to specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's IPv6 XFRM code mishandles socket references in local error paths, leading to potential out-of-bounds reads. This occurs because the code incorrectly assumes skb->sk always points to a full IPv6 socket, which is not guaranteed. The flaw affects specific Linux kernel versions and has a CVSS score of 7.8, indicating a medium severity.
A vulnerability in the Linux kernel's dma-buf/dma-fence subsystem was addressed by improving checks to prevent a potential use-after-free condition. The issue involved improper handling of the signaling bit and ops pointer, which could lead to dereferencing a NULL pointer or losing RCU protection after signaling. The fix adds an additional signaling check alongside the ops pointer check to ensure both NULL dereference protection and RCU protection are maintained.
A vulnerability in the Linux kernel's openvswitch component was resolved that involved unsafe reallocation of confirmed conntrack labels. The issue occurred because confirmed conntrack entries could be read locklessly, and adding a labels extension could cause reallocation and freeing of memory while another CPU was accessing it. The fix ensures that extensions are only added for unconfirmed conntracks, preventing unsafe memory operations.
A refcount bug in the Linux kernel's RDMA core component (iwpm_get_nlmsg_request function) was fixed. The vulnerability involved initializing the reference count after adding the object to a global list, allowing concurrent CPUs to incorrectly increment a zero refcount, causing a refcount 'addition on 0' bug. The fix initializes the refcount before adding to the list and ensures all fields are initialized beforehand. This affects specific linux-aws kernel versions.
A vulnerability in the Linux kernel's RDMA/ucma subsystem related to multicast join and leave operations has been resolved. The issue involves improper serialization of join and leave calls on copy_to_user failure, which could lead to use-after-free conditions. This occurs when two concurrent join multicast calls with the same address cause a race condition, potentially allowing an older worker to dereference freed memory. The fix ensures the mutex is held properly during these operations to prevent this race.
A vulnerability in the Linux kernel's swiotlb component caused incorrect handling of high memory page lookups during DMA operations, leading to data being copied to or from incorrect memory pages. This flaw affects certain Linux kernel versions and has been resolved.