In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte control buffer at the end of it holding the next chunk's pointer and its length. If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the calculated last chunk length is wrongly computed as 0, even though that chunk is fully populated with 510 real page pointers. This wrong length is used both to DMA map the chunk and is propagated to the device, causing the device to see the chunk as empty and reject the memory registration. Fix the calculation so it will be performed only if the number of pages isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in the above loop correctly. Also prevent out-of-bounds reach in the chunks array in such scenario.
In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
A vulnerability in the Linux kernel's mac80211 subsystem involves improper handling of reconfiguration failures for NAN (Neighbor Awareness Networking). When NAN reconfiguration fails, the function ieee80211_handle_reconfig_failure is called unnecessarily, which incorrectly marks all interfaces as not in the driver. This can cause drivers to retain dangling pointers to objects like stations and links, potentially leading to instability or crashes. The issue has been fixed by changing the code to only warn in such cases instead of calling the problematic function.
A vulnerability in the Linux kernel's bcm2835 pinctrl driver could cause a kernel panic due to a null pointer dereference when the GPIO chip removal function is called on an unregistered chip. This occurs if devm_pinctrl_register() fails and gpiochip_remove() is called before the GPIO chip is registered. The issue has been fixed by removing the unnecessary call to gpiochip_remove().
CVE-2026-93248 addresses a Linux kernel vulnerability in the drm/xe driver where a kernel job timeout warning is incorrectly triggered when the device is already wedged. The issue occurs during driver unbind when a GSC proxy kernel submission times out but cannot complete due to the device being wedged. This causes the kernel to issue a warning and taint the kernel unnecessarily. The fix ensures that the timeout handler recognizes an already wedged device and suppresses the warning.
The volume of publicly disclosed software vulnerabilities is projected to nearly double within a year, largely attributed to the influence of AI in both discovering and introducing vulnerabilities. While the increase in vulnerabilities may seem concerning, it is expected to be a transitional phase leading to more secure software development as AI improves. This trend suggests an initial surge in vulnerability counts followed by a decline as AI learns to code more securely.
The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being properly sanitised when another user, including administrative staff, views the affected profile. Successful exploitation could allow JavaScript code to be executed in the victim’s browser, access to information available within the session, or the performance of actions using the victim’s permissions.
A use-after-free vulnerability in the Linux kernel's iommu/tegra241-cmdqv driver was resolved. The issue involved the devm_krealloc() function freeing the original smmu pointer but the caller subsequently dereferencing this freed pointer on a fallback path. This could lead to memory corruption and potentially impact confidentiality, integrity, and availability of the system.
A vulnerability in the Linux kernel's Btrfs zoned filesystem handling could cause corruption of the extent tree by zeroing out an extent buffer that is still referenced in memory. This occurs when a freed-but-still-dirty tree block is written as zeros to advance the zone write pointer, but the zeroing operation destroys the in-memory buffer header. This leads to potential assertion failures or aborts when the buffer is later accessed. The issue has been resolved by changing the zeroing method to preserve the in-memory buffer content.
A vulnerability in the Linux kernel ALSA sequencer subsystem could leak kernel memory addresses to unprivileged userspace. This occurs because the bounce payload sent to userspace includes a pointer to an internal extension cell, exposing an address from kernel memory. The flaw affects the handling of variable-length events when using the bounce filter on non-existent ports.
A vulnerability in the Linux kernel's AMT driver involves improper handling of cross-network namespace (netns) setups. Specifically, when a lower network device is unregistered, the AMT device event handler attempts to unregister its upper AMT device but only looks up upper devices within the same netns. This leads to issues if the AMT device is created on a lower device in a different netns, causing the system to hang during device removal. The fix forbids cross-netns setups for AMT devices to prevent this problem.
A vulnerability in the Linux kernel's vsock subsystem causes vsock_accept() to incorrectly reject valid incoming connections due to stale error states from previous failed connection attempts. This leads to resource leaks on certain transports because child sockets created for new connections are never freed.
A vulnerability in the Linux kernel's HID haptic driver caused uninitialized values to be written to unhandled usage fields. This flaw was fixed by skipping unhandled usages to prevent writing leftover or uninitialized data. The issue was identified through static analysis and affects specific Linux kernel versions.
