A use-after-free vulnerability in the Linux kernel's tracing subsystem was fixed by preventing dereferencing of a freed trace_event_file during deferred trigger free operations. This issue occurred because the enable_event trigger deferred freeing a trace_event reference to a kernel thread, but the trace_event_file could already be freed when the instance was removed. The fix involved keeping the trace_event_call directly in enable_trigger_data to avoid accessing freed memory.
A vulnerability in the Linux kernel tracing subsystem (user_events) causes event fields to be destroyed prematurely if event removal fails, leaving the event in an inconsistent state with an empty field list but still visible in tracefs. This can lead to incorrect behavior when interacting with the event.
A vulnerability in the Linux kernel Bluetooth subsystem (btrtl) involves leaking an uninitialized return code when parsing firmware format version 2. This occurs when the key_id from the chip is zero, causing the function rtlbt_parse_firmware_v2() to improperly handle security headers and leak return codes from previous sections. The issue has been fixed by correcting the loop control flow to properly skip sections and improve code readability.
A Linux kernel vulnerability in version 6.8 causes the thaw operation in nested filesystem freezes to incorrectly return an error code (-EINVAL) despite successfully releasing a freeze hold. This leads to a leaked freeze count on block devices when multiple freeze mechanisms are used, such as filesystem freeze (FIFREEZE) combined with block device freeze (bdev_freeze). The leak prevents the block device from being mounted again after unmounting, requiring a device destruction or system reboot to recover.
A vulnerability in the Linux kernel's io_uring/net subsystem involving improper buffer consumption when using the MSG_TRUNC flag with recv/recvmsg calls has been fixed. The issue caused io_uring to advance more of the buffer ring than was actually filled when the incoming packet was larger than the provided buffer. This could lead to incorrect buffer handling during network packet reception.
A vulnerability in the Linux kernel's bnxt_en driver involves improper handling of the live ring's TPA state during queue restart failure. Specifically, pointers to the live ring's memory are not properly cleared in a cloned structure, leading to potential freeing of memory still in use. This issue has been fixed by initializing the clone's pointers to NULL to prevent inadvertent freeing of live ring state.
A vulnerability in the Linux kernel's XFS filesystem code could cause the system to spin indefinitely when processing zero-length directory entries during directory salvage operations. This issue has been fixed in specific commits to prevent infinite spinning on zero-length dirents.
A vulnerability in the Linux kernel's XFS filesystem code could cause a locked buffer to be leaked if an IO error occurs during buffer list write operations. This issue has been fixed in specific commits.
A memory leak vulnerability in the Linux kernel's XFS filesystem was fixed. The flaw involved the function xqcheck_mod_live_ino_dqtrx not freeing a newly allocated dqa object if insertion into a resizable hash table (rhashtable) failed, causing a resource leak.
A vulnerability in the Linux kernel's ath9k_htc wireless driver involved storing a usb_device_id that may not persist beyond the probe phase due to dynamic IDs. The issue was resolved by changing the code to store only driver_data, which is reliably accessible from the usb_device structure.
A vulnerability in the Linux kernel's net: usb: pegasus driver involves incorrect pointer arithmetic on the usb_device_id table when dynamic IDs are used. This flaw causes out-of-bound indexing due to the usb_device_id parameter residing on the heap. The issue has been addressed by changing the handling of dynamic IDs to use the driver_info field and removing problematic pointer arithmetic.
A vulnerability in the Linux kernel's xusbatm USB driver was fixed to prevent reliance on unsafe pointer arithmetic involving dynamic USB device ID tables. The flaw caused out-of-bounds pointer arithmetic when dynamic IDs were used, which the driver could not properly support. The fix involved avoiding this pointer arithmetic and disabling dynamic ID support for xusbatm.
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.
Security Fix(es):
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.(CVE-2026-17084)
Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass unbounded input to csv.Sniffer.sniff().(CVE-2026-18503)
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.(CVE-2026-19672)
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.(CVE-2026-82049)
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.(CVE-2026-87910)
A vulnerability in the Linux kernel's RDS RDMA networking code caused a hang during shutdown of InfiniBand network configurations. The issue was due to a worker thread sleeping indefinitely on a wait_event call, blocking other queued work. This was fixed by changing the wait_event call to a wait_event_timeout loop, preventing the hang.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem was resolved. The issue involved improper handling of reconfiguration failures for NAN (Neighbor Awareness Networking) interfaces, where a function was called unnecessarily, potentially leaving driver pointers dangling. This could cause instability or incorrect driver behavior. The fix prevents the unnecessary call and instead issues a warning, aligning with other error paths.
In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2 (UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind, a GSC proxy kernel submission can still time out; with the device wedged and the GuC CT stopped it can never complete, so its kernel job times out. Tile0: GT1: Kernel-submitted job timed out WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:... at guc_exec_queue_timedout_job() Workqueue: gt-ordered-wq drm_sched_job_timedout Killed queues skip guc_submit_hint_wedged(), leaving 'wedged' false even though the device is already wedged. The timeout handler then treats the kernel queue timeout as unexpected and taints the kernel. Honour an already-wedged device even for killed queues so the expected teardown timeout no longer trips the WARN. (cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)
In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock: warn when freeing reserved memory before memory map is initialized"), the following warning was hit when there was a "nohz_full" kernel boot parameter. Cannot free reserved memory because of deferred initialization of the memory map WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0 : Call Trace: <TASK> memblock_phys_free+0xcb/0x100 housekeeping_init+0x14c/0x170 start_kernel+0x207/0x450 x86_64_start_reservations+0x24/0x30 x86_64_start_kernel+0xda/0xe0 common_startup_64+0x13e/0x141 </TASK> IOW, we shouldn't free memblock allocated memory so early in the boot process when memory map isn't fully initialized in deferred_init_memmap(). Fix it by saving the housekeeping cpumask memblock memory to be freed into a llist free list in housekeeping_init() and add a new housekeeping_late_init() helper to defer the actual freeing of memblock memory to when initcall's are being processed. The cpumask memblock memory is treated as a llist_node with the size of a "long" type which is also smallest cpumask size that can be allocated. The non-atomic version of the llist APIs are used as there is no contention. This commit depends on the presence of commit 7c2eee9c1367 ("memblock: don't touch memblock arrays when memblock_free() is called late") to prevent a KASAN UAF bug report [1]. [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during resume. When a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF exceptions are masked (by virtue of `local_daif_save()`), and the suspended image is saved assuming that all DAIF exceptions will remain masked when the image is restored. When a hibernation image is resumed by `swsusp_arch_resume()`, only interrupts are masked (by virtue of `local_irq_disable()` in `resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits will be clear, and regardless of pseudo-NMI the DAIF.DA bits will be clear. This means that there are two problems: (1) It is possible to take Debug, SError, or pseudo-NMI exceptions during the resume process. This is unsafe, as during the resume process both the old ane new kernels will tranisently be in an inconsistent state, and swsusp_arch_suspend_exit() won't retain an executable mapping of any exception vectors. Any exception taken here will be fatal and silent. (2) When re-entering the resumed kernel, some DAIF bits will be clear unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions to be taken for a short period while the resumed kernel is not yet in a consistent state. This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING. Avoid these issues by masking all DAIF exceptions during resume.