A security vulnerability has been identified in michaelrsweet mxml version 4.0.5 and several other specific versions. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires network access with low attack complexity and privileges, and user interaction is needed. The impact includes limited confidentiality, integrity, and availability losses. No public exploit or known active exploitation has been reported. The affected versions include multiple specific builds from 2.7-1 through 4.0.4-6.
A medium severity vulnerability (CVE-2026-112077) was detected in radareorg radare2 affecting multiple versions including 0.9.6-3.1ubuntu1 through 6.1.8+ds-1. The CVSS 3.1 score is 5.6, indicating a network attack vector with high attack complexity and no privileges or user interaction required. The impact includes low confidentiality, integrity, and availability impacts. No public exploits or known active exploitation have been reported. The vulnerability affects various Ubuntu package versions of radare2.
A medium severity vulnerability (CVE-2026-112036) was detected in Artifex MuPDF up to version 1.28.5. The flaw impacts availability but does not affect confidentiality or integrity. No public exploits or active exploitation in the wild are known. The vulnerability was published on October 23, 2026.
CVE-2026-98864 is a medium severity vulnerability in the Linux kernel scheduler extension (sched_ext) where a task can be re-enqueued prematurely due to improper waiting for the SCX_OPSS_DISPATCHING state to clear. This flaw could cause the dispatcher's final state update to overwrite the queued state, resulting in dropped dispatches of the task. The issue affects multiple specific Linux kernel versions, including various 4.15.x, 5.0.x, and 5.3.x builds. The vulnerability has been addressed by ensuring the scheduler waits for SCX_OPSS_DISPATCHING to clear before re-enqueueing tasks, aligning with the behavior in ops_dequeue().
CVE-2026-98832 is a medium-severity vulnerability in the Linux kernel's blk-cgroup subsystem related to improper handling of interrupt (IRQ) state in the blkg_tryget_closest() function. The flaw involves enabling local interrupts unconditionally when releasing a spinlock, which can lead to deadlocks if interrupts were already disabled by the caller. This issue affects certain Linux kernel versions used in various Ubuntu LTS releases.
A vulnerability in the Linux kernel KVM x86 subsystem could cause stale, unpinned page frame numbers (PFNs) to be reused when nested virtualization pages fail to be retrieved. This occurs if the GET_NESTED_STATE_PAGES request is not properly re-pended before exiting to userspace, potentially leading to stale mappings in nested virtual machine control structures. The issue affects specific Linux kernel versions and has been resolved by ensuring the request is correctly handled on VM exit.
A vulnerability in the Linux kernel kprobes subsystem involves improper handling of disarmed probes when checking for optimized probe overlaps. This flaw can cause execution to jump to an incorrect address due to an INT3 instruction overwriting part of a jump displacement in optimized probes. The issue affects specific Linux kernel versions and has been resolved by skipping disarmed probes during overlap checks.
CVE-2026-98853 is a vulnerability in the Linux kernel's network generic segmentation offload (GSO) implementation. It involves unbounded recursive IP-in-IP segmentation that can exhaust the kernel stack due to improper tracking of nested IP headers. The flaw affects IPv4 and IPv6 GSO handlers and is mitigated by limiting recursion depth using an existing recursion limit. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-98843 is a medium severity vulnerability in the Linux kernel's netfs subsystem. It involves improper handling of gaps in the read-gaps folio during streaming writes, which can cause stale data to be written back to the server. The issue arises because netfs_read_gaps() leaves gaps unread around a dirty region, and a short or EOF response can leave stale folio content that later gets written back. The fix involves zeroing these gaps after the read completes to prevent stale data from being written back.
CVE-2026-98839 is a vulnerability in the Linux kernel's virtual terminal (vt) selection code. It involves an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. The issue arises when a concurrent ioctl call modifies the selection buffer while paste_selection() is sleeping, causing an underflow that leads to reading memory beyond the allocated buffer. This flaw has been fixed by adding a loop termination condition to prevent out-of-bounds access.
A medium severity vulnerability in the Linux kernel's virtual terminal (vt) subsystem causes an out-of-bounds memory access when updating the screen for invisible virtual consoles after a font size change. This occurs because the framebuffer backing buffer is not resized for invisible consoles, but the update routine is called without checking console visibility, leading to a slab-out-of-bounds read. The issue has been fixed by adding a visibility check before screen updates.
CVE-2026-98837 is a use-after-free vulnerability in the ALSA caiaq driver in the Linux kernel. The flaw occurs when the input device is registered during probe but not properly unregistered if subsequent initialization steps fail, leading to a dangling pointer. Accessing the input device's "uevent" attribute after this failure causes a kernel memory read of freed memory, triggering a KASAN slab-use-after-free error.
A vulnerability in the ALSA line6 driver in the Linux kernel allows oversized playback packets to be processed without proper size validation, leading to out-of-bounds memory writes. This occurs because the driver does not verify that the number of bytes written fits within the allocated buffer slice, potentially causing memory corruption. The flaw arises from a mismatch in packet size calculations between IN and OUT USB endpoints. This issue has been resolved by rejecting packets that exceed the allocated buffer size.
A boundary check flaw in the Linux kernel driver for the Kionix KX022A accelerometer was fixed. The driver incorrectly allowed an array index equal to the array size, which is out of bounds. This was corrected by ensuring the index is strictly less than the array size.
A double-free vulnerability in the Linux kernel's mtd core component related to the OTP NVMEM device registration and teardown has been resolved. The flaw occurs if factory OTP setup fails after user OTP NVMEM device registration, leading to multiple unregister attempts without clearing the pointer, causing a double-free condition.
CVE-2026-98833 is a low severity vulnerability in the Linux kernel's memory technology device (MTD) core. The issue involves improper handling of the master MTD device in the _get_device() callback, which affects gluebi partitions relying on container_of() that require the master MTD. The flaw was fixed by ensuring the master MTD is passed correctly to _get_device(), matching the behavior of _put_device().
A vulnerability in the Linux kernel's of/overlay subsystem could cause fragment references to leak when the changeset initialization fails. This occurs because the count of initialized fragments is only stored on full success, leading to incomplete cleanup and potential resource leaks when partial initialization fails.
A vulnerability in the Linux kernel's wifi wfx driver allows a firmware response with an excessively large length field to cause a buffer over-read when copying data to a caller buffer. This occurs because the function wfx_hif_read_mib() does not validate that the firmware reply length fits within the caller's buffer size before performing the copy. The issue has been resolved by adding proper validation to prevent buffer overruns.
CVE-2026-98829 is a vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem where oversized fragments can cause an overflow in a 16-bit length field. This overflow leads to insufficient buffer allocation and a subsequent kernel crash when fragment data is appended. The issue arises because fragment lengths are accumulated in a 16-bit field that can wrap around if the total size exceeds 65535 bytes. The vulnerability has been fixed by adding checks to drop frames that would cause this overflow.
CVE-2026-98823 is a high-severity vulnerability in the Linux kernel's wifi cfg80211 component. It involves improper handling of hidden-group beacon Information Elements (IEs) during probe-response processing, which can lead to double-free errors and potential memory corruption. The flaw occurs when beacon IEs borrowed from a group's beacon entry are copied to an associated entry, resulting in two owners for the same allocation. This can cause use-after-free or double-free conditions when the group's beacon entry is released. The vulnerability has been resolved by skipping beacon IE replacement for hidden group entries while preserving normal probe-response processing.