Threat database

A vulnerability in the Linux kernel arm64 kprobes subsystem allowed improper handling of reentered kprobes during single-stepping, potentially causing incorrect interrupt state handling. The issue was that a kprobe hit in the KPROBE_HIT_SS state was treated as unrecoverable, leading to permanent interrupt disablement in some cases. This has been fixed by allowing reentry in KPROBE_HIT_SS to be handled correctly and preserving the interrupt state across nested kprobes.

A vulnerability in the Linux kernel's mac80211 WiFi component was resolved by validating the deauthentication frame length before accessing the reason code. The function ieee80211_rx_mgmt_deauth() previously read the deauthentication reason code without first confirming that the frame contained the expected fixed field, potentially leading to improper handling of malformed frames.

A vulnerability in the Linux kernel's drm/amdkfd component related to CRIU restore was resolved. The issue involved missing a call to properly acquire queue buffers in the set_queue_properties_from_criu() function, leading to uninitialized buffer fields in queue_properties. This could cause problems when subsequent code expects these buffer fields to be non-null. The fix added the missing call and corrected type casts.

A vulnerability in the Linux kernel's xen/gntalloc component was resolved by validating the grant count before allocation. The function gntalloc_ioctl_alloc() previously allocated memory for the grant-id array before verifying if the requested count was within the global grant limit, potentially leading to improper memory allocation. The fix involves rejecting counts above the limit before allocation and using a subtraction-based check under a mutex to prevent integer wraparound during count addition. Additionally, 64-bit arithmetic is used for page-size multiplication to ensure correctness.

A use-after-free (UAF) vulnerability in the Linux kernel's Thunderbolt hotplug handling was resolved. The issue occurred because hotplug events could be processed after the domain was removed, potentially leading to unsafe memory access. The fix involves taking a domain reference before scheduling the hotplug handler to prevent this condition.

A vulnerability in the Linux kernel's arm_scmi firmware component was resolved by adding validation for the SENSOR_UPDATE payload size. The issue involved the parser not verifying that the received payload contained the expected number of sensor readings before parsing, potentially leading to processing truncated update notifications. The fix rejects truncated notifications before reading the variable array.

A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper use of dpaa2_switch_free_fd() on receive frame descriptors, which expects a valid socket buffer pointer but was incorrectly called on descriptors without one. The fix moves dma_unmap_page() handling directly into dpaa2_switch_rx(), ensuring proper memory freeing depending on whether an SKB was created.

A vulnerability in the Linux kernel's wifi nl80211 component was resolved by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.

A reference leak vulnerability was identified and fixed in the Linux kernel's ThunderX network driver. The flaw involved the cavium_ptp_get() function acquiring a reference to a PTP PCI device, which was not properly released if initialization failed, causing a resource leak.

A vulnerability in the Linux kernel ALSA sequencer OSS interface was resolved. The snd_seq_oss_read() function incorrectly checks buffer sizes when reading queued events, causing improper handling of undersized reads. This could lead to events being copied incorrectly or left queued, potentially causing unexpected behavior in applications reading sequencer events.

A vulnerability in the Linux kernel's media video-i2c driver was resolved by correcting the driver removal process. The fix involves using vb2_video_unregister_device() instead of video_unregister_device() to properly disconnect the vb2 queue before unregistering the video device.

A vulnerability in the Linux kernel's drm/amdgpu component related to the ATOM command table nesting depth has been resolved. The issue involved capping the nesting depth at 32 levels and returning an error (-ELOOP) when this limit was exceeded.

The PyPI package 'onsokets' version 0.1.0 contains malicious code designed for automated file exfiltration, targeting Android devices. This package is part of a campaign identified as 2026-10-proxyrubika, which has clear malicious intent related to information stealing.

The npm package 'skillward' versions 0.1.1 and 0.1.2 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise may lead to unauthorized access and control by an outside entity. Immediate removal of the package is recommended, but due to the potential full system compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the affected computer should be rotated from a different, secure machine.

The kestreljob package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but are designed to download and run remote malicious scripts. This campaign is coordinated and aims to provide multiple deceptive methods to load malicious code.

A critical vulnerability (CVE-2026-100886) affects Seetong models T8108, T8108P, T8116, and T8232 running version 4.6.1.4-build202604241011. The flaw exists in an unknown function of the Debug Service component, leading to improper authentication. This vulnerability can be exploited remotely without any privileges or user interaction. Public exploit code is available. The vendor was notified but has not responded or provided a fix.

A critical deserialization of untrusted data vulnerability (CVE-2026-112846) exists in ThemeREX Group Save Life save-life, allowing object injection. This affects versions up to and including 1.2.14. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

A critical deserialization of untrusted data vulnerability (CVE-2026-112857) exists in axiomthemes Reprizo plugin versions up to 1.0.8. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating severe impact. No patch or remediation details are provided in the available data.

CVE-2026-112852 is a high-severity vulnerability in ThemeREX Group Helion up to version 1.1.12. It involves deserialization of untrusted data, which allows object injection. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 8.1, indicating a network attack vector with high impact but requiring high attack complexity and no privileges or user interaction.

CVE-2026-112856 is a critical deserialization of untrusted data vulnerability in ThemeREX Group Vagabonds up to version 1.3.10. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are provided in the available data.