A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.
A heap out-of-bounds write vulnerability in the Linux kernel's ksmbd component was fixed in the krb5_authenticate() function. The flaw occurs because the calculation of available buffer space (out_len) for the Kerberos AP-REP token does not account for prior responses in a compounded SMB2 request, leading to an overestimation of buffer headroom. This causes a length check to erroneously pass, allowing memcpy() to write beyond the allocated buffer into adjacent kernel heap memory. The issue is resolved by correctly subtracting the offset of prior responses when computing the available buffer space.
A vulnerability in the Linux kernel's mlx5e driver related to AF_XDP zero-copy buffer management has been resolved. The issue involved stale XSK buffer releases during MPWQE refill retries, which could cause double freeing of buffers through stale pointers. The fix ensures that buffer release retries become idempotent by properly managing the release bitmap in error paths. Extensive testing showed no invalid descriptors, WQE errors, or kernel warnings after the fix.
A vulnerability in the Linux kernel IPv4 implementation was resolved by preventing an exception dump when a nexthop group shrinks during concurrent FIB dumps. The issue involved dereferencing a NULL pointer due to a race condition between fib_info_num_path() and fib_info_nhc() when nexthop groups are replaced with fewer paths.
A vulnerability in the Linux kernel's dm-integrity device was resolved that caused a NULL pointer dereference crash when the device was activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag was set. The issue occurred in the dm_integrity_resume function when it attempted to read the journal containing the bitmap. The fix prevents writes during resume if the device is activated in 'R' mode.
A vulnerability in the Linux kernel's KVM x86 implementation related to the per-vCPU MMIO cache has been resolved. The issue involved improper use of memslots in System Management Mode (SMM) address space, which could cause stale cache entries to remain valid after switching address spaces. This could lead to incorrect MMIO exits and bypass of KVM's write-tracking, potentially causing inconsistent nested EPT table states. The fix ensures the use of active memslots for caching and validation, preventing stale entries across address spaces.
A vulnerability in the Linux kernel related to IPv4 route notification size race conditions has been resolved. The issue involves asynchronous route notifications for hardware flag changes where concurrent modifications can cause legitimate size errors, leading to warnings that were not indicative of actual bugs. The fix removes these misleading warnings while maintaining proper error handling.
A vulnerability in the Linux kernel's sched_ext scheduler caused CPU hotplug operations to hang when tasks on a dying CPU were managed by the BPF scheduler. The issue arose because tasks on the dying CPU's runqueue (rq) were not properly re-enqueued, causing the hotplug thread to wait indefinitely. This was fixed by ensuring tasks are re-enqueued on the local dequeue and that dispatch operations continue until the runqueue goes offline.
A vulnerability in the Linux kernel's mlx5e driver related to XDP redirect to AF_XDP sockets could cause stale buffer pointers to be freed twice, leading to double publication of UMEM frames. This occurs when the RX ring is full and a refill retry partially succeeds, leaving some WQEs with stale buffer pointers. The issue was detected with high packet rates and causes silent failures without kernel warnings. A fix has been implemented to mark WQEs as released immediately after freeing buffers, preventing double free and stale pointer use.
A vulnerability in the Linux kernel's bnxt_en driver caused incorrect DMA mapping length for padded small packets, leading to potential DMA read overruns and Intel IOMMU faults. The issue arises when packets smaller than 52 bytes are padded but the DMA mapping length is not updated accordingly, causing the NIC to read beyond the mapped buffer. This was fixed by adjusting the padding method to ensure the DMA mapping length matches the padded packet size.
A vulnerability in the Linux kernel's IPv6 route notification handling was addressed by removing an incorrect warning related to route notification size races. The issue involved fib6_info_hw_flags_set() sizing a socket buffer and later filling it, where concurrent changes could cause legitimate size errors that were previously misinterpreted as bugs. The fix removes the misleading warning while preserving the existing error handling path.
A long-standing memory leak issue involving xarray nodes in the Linux kernel's clear_inode() function has been resolved. The leak, difficult to trigger previously, has been made more accessible through recent techniques involving madvise. The fix involves calling xa_destroy() to free excess xarray nodes and cycle the i_pages lock, addressing the leak more comprehensively.
A vulnerability in the Linux kernel's rust_binder component was resolved that involved improper handling of node refcount updates when a thread exits. Specifically, when a thread exits via BINDER_THREAD_EXIT while holding a pending node refcount increment, the increment could be dropped due to no-op cancel functions. This caused desynchronization between the node's delivery and count states, potentially preventing the node from being freed properly. The fix implements cancellation logic to reschedule the refcount update on thread exit, ensuring proper delivery to userspace.
A vulnerability in the Linux kernel's IPv4 PMTU handling was resolved. The issue involved a null pointer dereference caused by a race condition when the nexthop group shrinks during a PMTU walk. This could lead to a kernel oops. Exploitation requires CAP_NET_ADMIN capability in the network namespace, which can be obtained by a local user in a new user and network namespace if unprivileged user namespaces are allowed.
A vulnerability in the Linux kernel's readdir implementation related to inode locking on immutable directories has been resolved. The issue involved iterate_dir() holding a shared lock on the directory's i_rwsem semaphore even when the directory was immutable and never changed, causing unnecessary blocking. This could lead to stalls in mount namespaces sharing the same nullfs directory inode, impacting multiple users. The fix adds a FOP_IMMUTABLE flag to skip locking for directories that never change or are never removed, preventing the described contention.
A vulnerability in the Linux kernel's dm-integrity module was resolved involving improper validation of the superblock on resume. The dm_integrity_resume() function re-reads the superblock without validating it, allowing discrepancies if the superblock is modified while the device is suspended. This can lead to out-of-bounds memory writes during journal access. The fix involves snapshotting the validated superblock during construction and refusing to resume if critical fields have changed.
A vulnerability in the Linux kernel's vsock/virtio subsystem related to incorrect accounting of unread bytes in the read_skb() function has been resolved. The flaw caused the rx_bytes counter to underflow after partial stream receives, leading to incorrect socket status reporting and potentially hiding queued data until additional bytes arrived. This issue was identified during a manual source audit following a previous related vulnerability (CVE-2024-50169).
A vulnerability in the Linux kernel's IPv6 UDP exception cache handling allowed off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. The issue was due to exceptions being created only when a UDP packet matched an existing socket. The fix ensures exceptions are always created before socket matching, preventing this side-channel. This change may cause additional route lookups and exceptions but does not increase the ability of attackers to create exceptions beyond previous capabilities.
A vulnerability in the Linux kernel's device mapper ioctl interface was resolved where a buffer over-read could occur due to incorrect calculation of a data pointer. This issue involves the struct dm_ioctl, which has trailing padding causing the data_start pointer to run past the allocated buffer size. Although this results in an out-of-bounds read, it can only be triggered by root privileges and is therefore not considered a security bug. The fix clamps the data_start pointer to the buffer size to prevent the over-read.
A vulnerability in the Linux kernel related to IPv4 route notification sizing has been resolved. The issue involves improper handling of nexthop groups when they shrink, leading to a potential null pointer dereference in fib_nexthop_nlmsg_size(). This occurs because the code does not stop sizing when an indexed path is absent after a nexthop group replacement with fewer paths. The fix prevents dereferencing a null pointer by stopping sizing in such cases.