The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
* kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266)
* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
* kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)
Bug Fix(es) and Enhancement(s):
* kernel module .ko ELF files with non-zero sh_addr section addresses [rhel-10.2.z] (JIRA:RHEL-159298)
* sctp: prevent peer transport count overflow [rhel-10.2.z] (JIRA:RHEL-216247)
* [RHEL 10] bnxt_en: RX queue restart failed: err=-95 [rhel-10.2.z] (JIRA:RHEL-247283)
* RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:RHEL-259788)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in libical 4.0.6 involves an incompatible function pointer passed to bsearch() in the icalparameter_string_to_kind() function. This causes undefined behavior and process termination when parsing certain iCalendar data, resulting in a denial of service condition.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)
* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)
* kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)
Bug Fix(es) and Enhancement(s):
* [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:RHEL-213003)
* RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z] (JIRA:RHEL-254108)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Arc Search for Android versions prior to 1.12.10 do not show a fullscreen notification when a page enters fullscreen mode while the app runs in the background. This allows a remote attacker to craft websites that render fake UI elements, such as spoofed address bars, potentially misleading users about the content's origin and increasing phishing risk.
A vulnerability in Red Hat Ansible Automation Platform's automation-controller allows an authenticated administrator to exploit a Python format-string template used for logging API 4XX errors. This flaw permits reading sensitive application secrets such as the Django secret key and database password by crafting a malicious format string. The secrets can be exfiltrated via logs forwarded to external aggregators, potentially enabling offline decryption of stored credentials, session forgery, and direct database access.
CVE-2026-91777 is a high-severity vulnerability in FasterXML jackson-databind involving uncontrolled resource consumption (CWE-400). The flaw arises from inefficient handling of forward-reference completion for @JsonIdentityInfo object IDs, causing quadratic CPU usage during deserialization when processing attacker-controlled JSON with unresolved object-ID references. This can lead to denial of service via excessive CPU consumption. The issue affects multiple jackson-databind versions from 2.5.0 through 3.2.2. No exploits are currently known in the wild.
CVE-2026-91776 is a high-severity vulnerability in FasterXML jackson-databind that causes uncontrolled resource consumption. It arises from caching fallback deserializers for unrecognized type IDs without bounds, allowing attackers to cause memory retention by supplying many distinct unknown type IDs. This affects applications using name-based polymorphism with a fallback and a long-lived ObjectMapper. The vulnerability impacts multiple jackson-databind versions up to 3.2.2.
CVE-2026-89425 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.8.0 through 3.2.2 in various subranges. The issue arises in UTF8DataInputJsonParser._reportInvalidToken(), which accumulates malformed token text without any upper bound, leading to excessive memory use. This can cause the Java Virtual Machine to run out of memory and crash due to unbounded StringBuilder growth when processing large malformed tokens via the DataInput parsing path.
A stored cross-site scripting (XSS) vulnerability in GitHub Enterprise Server allowed authenticated attackers to inject arbitrary HTML attributes into rendered Markdown. This was due to the Markdown rendering pipeline rewriting quote characters in already-sanitized HTML without re-sanitizing the output. Exploitation could bypass Content Security Policy, enabling control of the page DOM when viewed by other users. Attackers could read visible content, extract CSRF tokens, perform actions as the victim, and exfiltrate data. The malicious payload could also spread to repositories and organizations where the victim had write access. The issue affected multiple supported versions and has been fixed in specific patch releases.
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
CVE-2026-89407 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.17.0 through 3.2.1 in specified subranges. It involves inefficient regular expression complexity in the NumberInput.looksLikeValidNumber() method, causing quadratic time complexity when processing certain numeric string inputs. This can lead to denial-of-service conditions by exhausting server resources during JSON deserialization of numeric types. The issue does not exist before version 2.17.0 and has been fixed by replacing the problematic regex with a single-pass scan.
vLLM versions up to 0.29.0 have a denial of service vulnerability in the P2P KV offloading feature when configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can cause the system to crash by supplying arbitrary unreachable remote host and port values, exhausting context quotas and triggering an uncaught error that stops all inference.
Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently implemented a custom virtual machine executed via a lightweight bytecode interpreter combined with custom stream ciphers that change per build. The VM uses 14 opcode handlers with simple primitives including XOR, addition, rotation, and substitution. Version 2.0 introduced this VM approach, while versions 2.2 and later added ARX-based custom stream ciphers using FNV-1a hashing and golden ratio constants. These per-build variations in opcodes, constants, and substitution tables significantly hinder static and automated analysis capabilities.
web2py version 3.2.2-stable contains a directory traversal vulnerability in the read_file() and write_file() functions within applications/admin/controllers/webservices.py. This flaw allows an attacker with high privileges to read or write arbitrary files on the server, potentially leading to confidentiality and integrity breaches. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-91203 is a race condition vulnerability in cockpit-files on Red Hat Enterprise Linux 10. It allows a local attacker to exploit a symlink race during privileged file operations, such as changing file ownership or permissions. By winning this timing race, the attacker can redirect these operations to arbitrary files, potentially causing unauthorized changes to file ownership and permissions. This may compromise system integrity and availability by altering system or application states or making services unusable.
WinFsp versions through 2.2.26215 have a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler. This flaw occurs because the volume context is not validated before use. An unprivileged local user can exploit this to cause a denial of service by opening the WinFsp control device and issuing specific requests, resulting in a system crash.
A suspicious URL (https://xysrx.com/PV.js) was found embedded below the closing HTML tag on the homepage of a website serving Clickfix. The JavaScript code fetched from this URL collects visitor environment data such as theme preference, timezone, screen resolution, and browser automation status, encodes this data, and conditionally injects additional HTML content triggered by user interactions like mouse clicks. This behavior suggests potential unauthorized content injection or tracking. No official vendor advisory or patch information is available.
gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce->steps_removed (accepted up to 254), never from announce->tlv.len, which is the field that states how many identities the TLV actually carries. Because path_sequence is the flexible member of the wire TLV (struct gptp_path_trace_tlv) and GPTP_ANNOUNCE() yields a raw pointer into the received packet buffer, the memcmp() inside the loop can address memory well past the end of the received frame.
The stack's only length validation, GPTP_ANNOUNCE_CHECK_LEN(), requires the received gPTP payload to be exactly 68 + tlv.len bytes — so it does not constrain the loop, it guarantees the data is absent. An unauthenticated attacker on the same Ethernet segment can send a single Announce frame declaring tlv.len = 0 with steps_removed = 254; the frame passes the length check and reception path (net_gptp_recv() → gptp_handle_msg() → gptp_mi_qualify_announce()), which performs no authentication, and the loop then reads 255 entries of 8 bytes each — about 2 KB — beyond the end of the network buffer.
The impact is an out-of-bounds read. The bytes read are only used as a memcmp() operand and are never returned to the attacker, so there is no meaningful information disclosure; the practical risk is that the overread crosses a network buffer pool boundary into unmapped or MPU-protected memory and faults the networking RX thread, causing a denial of service. Exposure is limited to builds that enable the opt-in, experimental CONFIG_NET_GPTP (TSN/AVB deployments) and to attackers with layer-2 adjacency, since gPTP frames are sent to a link-local multicast address and are not routed.
The fix computes the true entry count as tlv.len / GPTP_CLOCK_ID_LEN and rejects the announce when steps_removed + 1 exceeds it, so the loop can no longer run past the data the packet-length check proved present.
A resource leak vulnerability in the Linux kernel's asus-wmi driver was fixed by correcting the error handling sequence during driver initialization. The issue caused resource cleanup steps to be skipped on certain initialization failures, leading to leaks of input device, sysfs groups, backlight, and rfkill resources.