CVE-2026-14366 is a use-after-free vulnerability in the Silicon Labs SiWx917 WiFi driver within the Zephyr project. The driver incorrectly frees a network packet it does not own during transmission, leading to use-after-free and double free conditions. This can cause memory corruption in the kernel networking buffer pool, resulting in transmit hangs and crashes. The flaw is triggered by normal network transmissions over the affected WiFi interface and can be induced by an adjacent attacker on the same WiFi network. The issue is fixed by removing the erroneous packet unreference call in the driver.
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race.
Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to.
This issue affects zbus_polkit before 5.1.0.
CVE-2026-75760 is a vulnerability in ash-project's ash_ai component that causes error messages to leak sensitive information. When the embedding provider call fails in AshAi.Changes.Vectorize, the error message includes unsanitized details such as the request URL, provider response body, and potentially the Authorization header containing the API key. This information is exposed to users via validation errors. The issue affects versions from 0.1.0 up to but not including 1.0.0. The vulnerability has a high severity score of 7.1.
Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic.
AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run.
This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Qubes OS versions prior to qubes-core-dom0-linux 4.3.22 contain a vulnerability that allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube. The issue arises because the system library function is used to process an error message that may include shell metacharacters, leading to potential command execution.
CVE-2026-78228 is an uncontrolled recursion vulnerability in the ash-project's ash_oban component. It occurs when a user's on_error trigger action fails on the final job attempt, causing infinite recursion that exhausts CPU and memory, leading to denial of service. The issue affects versions from 0.8.0-rc.1 up to but not including 0.8.14. The vulnerability results from a recursive call to handle_error/4 that is not in tail position, causing unbounded memory growth and eventual worker process termination.
A vulnerability in the Linux kernel's tracing/probes subsystem was addressed by removing a WARN_ON_ONCE() call from the parse_btf_arg function. The issue was that a user could easily trigger this warning by adding a kprobe event based on a raw address with a BTF parameter, which was not considered an unexpected condition. This fix removes the warning to prevent unnecessary alerts. The vulnerability affects specific versions of the linux-hwe-edge kernel and has been patched. No known exploits are reported in the wild.
A vulnerability in the Linux kernel's drm/vmwgfx driver allows oversized cursor sizes on the SVGA_CAP2_CURSOR_MOB path, which is the default on modern hosts. This flaw occurs because cursor size limits are only enforced on the legacy update path, not on the MOB cursor path. When an oversized cursor is requested, the driver mishandles error returns, leading to a NULL pointer dereference and kernel oops. This can be triggered by any DRM master via a specific ioctl call with a cursor size exceeding defined maximum dimensions.
A null pointer dereference vulnerability was fixed in the Linux kernel's drm/rockchip dw_dp_remove() function. The issue arises because the platform driver remove callback may attempt to access driver data without guarantee that the component bind callback has set it, potentially causing a null pointer dereference. This occurs if the Rockchip DRM driver fails to run component_bind_all() due to an unrelated error. The fix removes the unnecessary call to platform_get_drvdata() and references the device structure directly.
CVE-2026-80626 is a medium severity vulnerability in the Linux kernel affecting the powerpc/perf subsystem. The flaw involves a preempt count underflow caused by an unmatched preempt_enable() call in the fsl_emb_pmu_del() function when event->hw.idx is negative. This can lead to a 'scheduling while atomic' kernel BUG on preemptible kernels (CONFIG_PREEMPT=y). The issue has been fixed by properly pairing get_cpu_var() and put_cpu_var() calls to prevent the underflow. Multiple Linux kernel versions are affected, and patches have been released to address the flaw.
A vulnerability in the Linux kernel's batman-adv module was resolved. The issue involved the function batadv_get_vid() accessing the ethernet header's proto field without verifying data accessibility, which could lead to out-of-bounds memory access. This flaw was specifically due to batadv_dat_get_vid() and its caller not ensuring the data was accessible, unlike other call sites. The vulnerability has a CVSS score of 8.1, indicating a high impact on confidentiality and availability. A patch is available to address this issue.
A vulnerability in the Linux kernel's net/mlx5 subsystem was fixed where a missing call to complete() on a devcom error in mlx5_mpesw_work() could cause a caller waiting on a completion event to block indefinitely. This issue was resolved by ensuring the early-return path triggers the completion event, preventing indefinite blocking.
A vulnerability in the Linux kernel's UFS core tracing subsystem was fixed to prevent kernel crashes caused by dereferencing pointers that may no longer be valid when trace events are read. The issue involved unsafe pointer dereferencing in TP_printk() which could lead to use-after-free conditions. The fix involves saving device names at tracepoint call time instead of dereferencing pointers later. This vulnerability affects specific Linux kernel versions and has a CVSS score of 7.8. A patch is available to address this issue.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a reference it does not own. It takes one transient reference via sco_conn_hold_unless_zero() and releases it with the sco_conn_put() that follows sco_sock_hold(); the additional put in the !sk branch releases a second one: conn = sco_conn_hold_unless_zero(conn); ... sk = sco_sock_hold(conn); sco_conn_unlock(conn); sco_conn_put(conn); if (!sk) { sco_conn_put(conn); return; } When close() races the controller's Disconnection Complete, sco_chan_del() clears conn->sk and drops the socket's reference while sco_conn_del() is running. sco_conn_del() then sees sk == NULL, its own put drops the count to zero and frees the conn, and the second put writes to the freed kref: BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190 Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413 Workqueue: hci1 hci_rx_work Call Trace: sco_conn_put.part.0+0x1a/0x190 hci_disconn_complete_evt+0x1ee/0x3e0 hci_event_packet+0x54a/0x650 hci_rx_work+0x321/0x3d0 Allocated by task 413: sco_conn_add+0x72/0x1a0 sco_connect_cfm+0x88/0x670 Freed by task 413: sco_conn_del.isra.0+0x3f/0xf0 hci_disconn_complete_evt+0x1ee/0x3e0 refcount_t: underflow; use-after-free. The root cause is that the socket stores the connection without holding a reference of its own. __sco_chan_add() does: sco_pi(sk)->conn = conn; so the socket borrows whatever reference its caller happened to hold, and the callers paper over that with ad-hoc holds and puts. Give the socket a counted reference instead: __sco_chan_add() takes one and it is released together with the channel (sco_chan_del()) and in sco_sock_destruct(). With the socket holding its own reference, sco_conn_del() no longer needs the extra put and the redundant hold in sco_conn_ready() goes away. Making the socket own its reference means the connection is now actually freed on the error paths of sco_connect() where it used to leak, which in turn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the hci_conn accounting balanced, make that ownership explicit as well: sco_conn_add() consumes one hci_conn reference and the sco_conn owns it for its lifetime. sco_connect() hands over the reference returned by hci_connect_sco() and no longer drops it on the error paths; sco_connect_cfm(), which is not given a reference, takes one with hci_conn_hold() before handing it to sco_conn_add() (and drops it again if the allocation fails); and the explicit hci_conn_hold() in sco_conn_ready() is removed. Every reference then has a single, clear owner.
A call trace issue in the Linux kernel's igen6_edac driver was fixed by adding missing release() functions for memory controller devices. The problem caused warnings during driver unload due to the absence of a release() function, which is required for proper device cleanup.