PostgreSQL Anonymizer versions prior to 3.3.0 have a vulnerability where data returned by a sub-query in a rule is not properly masked. This could lead to unauthorized exposure of sensitive data. The issue is fixed in version 3.3.0 and later.
PostgreSQL Anonymizer versions prior to 3.3.0 do not mask data accessed through security_invoker views, potentially exposing sensitive information. This issue is resolved in version 3.3.0 and later.
PostgreSQL Anonymizer versions prior to 3.3.0 do not invalidate prepared query plans after a rule is added or a role is changed. This allows users executing such prepared plans to see unmasked data until the session ends. The issue is fixed in version 3.3.0 and later.
PostgreSQL Anonymizer's anon.image_blur() function fails to validate the declared dimensions of an input image, allowing attackers to supply small images with falsely large declared dimensions. This can cause excessive memory consumption leading to backend process termination and cluster-wide crash recovery. The issue is fixed in version 3.3.0 and later.
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
A vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem involving the handling of RDMA connection IDs during route failure has been resolved. The flaw allowed the RDMA connection manager to destroy an ID that RDS still owned, leading to a connection state with a freed ID until shutdown. The fix ensures that the connection ID remains owned by RDS until proper shutdown, preventing use-after-free conditions.
A vulnerability in the Linux kernel's x86 KVM subsystem involves improper handling of asynchronous page fault (async #PF) flags during a kernel page fault in non-maskable interrupt (NMI) context. This race condition can cause a kernel panic when an NMI triggers a page fault that clears async #PF flags prematurely. The issue has been resolved by ensuring the async #PF flags are not consumed in this scenario, preventing the panic.
CVE-2026-99170 is a Linux kernel vulnerability involving mount namespace handling where a mount that copy_tree() omits can take over a lock, allowing a root task in its own user namespace to remove a locked mount cover without a race or modifying the underlying filesystem. The issue arises from improper handling of locked mounts of mount namespace files during mount tree copying and moving operations. The vulnerability was addressed by refusing to leave out or move such locked mounts, preventing unshare() failures and unauthorized mount removals.
A vulnerability in the Linux kernel's drm/exec subsystem involves improper handling of prelocked objects during contention. The drm_exec object may hold the last reference to a prelocked object that is about to be destroyed, leading to the object never being explicitly locked or reserved for dma_fence slots. This can cause warnings or kernel BUG_ON() errors, potentially leading to memory corruption. The issue is fixed by deferring adding the prelocked object to the array of locked objects until explicitly referenced again by the driver.
A vulnerability in the Linux kernel's drm/xe component involves incorrect page accounting when the purgeable state of pinned buffer objects (bos) changes. This flaw causes underflow and inflation of shrinkable and purgeable page counts, potentially leading to resource mismanagement.
A vulnerability in the Linux kernel's AMDGPU driver involves improper handling of runtime power management references in the amdgpu_gpr function. Specifically, the runtime PM reference is dropped twice when copying wave register data to userspace fails, leading to a runtime PM usage count underflow. This issue affects the amdgpu_debugfs_gpr_read() function and can cause incorrect power management state accounting on affected hardware.
A deadlock vulnerability in the Linux kernel's XFS filesystem was fixed by changing how buffer locks are handled during synchronous transaction commits in xfs_sync_sb_buf. Previously, buffer locks were held across the commit, which could cause deadlocks during shutdown when the CIL push workqueue was flushed. The fix removes calls that held these locks during commit and reacquires buffers afterward for on-disk writeback.
CVE-2026-99130 is a Linux kernel vulnerability in the io_uring subsystem where an exiting task can spin indefinitely on local work it cannot run. This occurs when a disabled io_uring ring is enabled by another task, causing the exiting task to burn CPU cycles or potentially panic the kernel if configured. The issue arises because the exiting task assumes it is the submitter of the ring and refuses to sleep while local work is pending, but this assumption is invalid for disabled rings enabled by other tasks.
A vulnerability in the Linux kernel's CIFS client was fixed to prevent incorrect inode size updates during file truncation when no cached handle is available. The issue caused the inode size to be set to zero locally while the server file remained unchanged, leading to inconsistent file size states.
A use-after-free vulnerability in the Linux kernel's bridge multicast code was resolved by correcting how port groups are walked and deleted during teardown. The flaw involved improper handling of linked list pointers during multicast port group deletion, which could lead to a kernel slab-use-after-free bug detected by KASAN.
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: hdmi: Move packet RAM enable to PM runtime
Audio can be triggered by the HPD handler and start up before video has
been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.
vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the
infoframe, however, if the video hasn't been enabled,
vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the
Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,
causing the following splat:
[ 201.570266] ------------[ cut here ]------------
[ 201.570293] Packet RAM has to be on to store the packet.
[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606
[...]
[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 201.758499] Call trace:
[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)
[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]
[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]
[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]
[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]
[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]
[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]
[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]
[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]
[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]
[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]
[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]
[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]
[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]
[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]
[ 201.846802] __arm64_sys_ioctl+0x88/0xd8
[ 201.850769] invoke_syscall+0x48/0xf4
[ 201.854470] el0_svc_common+0x80/0xd8
[ 201.858171] do_el0_svc+0x1c/0x28
[ 201.861520] el0_svc+0x3c/0xb0
[ 201.864605] el0t_64_sync_handler+0x68/0xdc
[ 201.868834] el0t_64_sync+0x198/0x19c
[ 201.872536] ---[ end trace 0000000000000000 ]---
Considering that Packet RAM enable is essentially a power management
configuration, move its enabling/disabling to the Runtime PM hooks.
Note that post_crtc_disable() still stops all infoframes, but keeps Packet
RAM enabled, leaving it to be disabled by runtime suspend.