CVE-2026-31645 is a vulnerability identified in Microsoft software version 3.0 related to a page pool leak in error paths within the net: lan966x component. The provided information does not include technical details beyond the existence of this memory leak issue. No CVSS score or detailed impact description is available.
CVE-2026-31560 is a vulnerability related to the SPI driver component, specifically spi-dw-dma, involving an error in printing logs when waiting for a transaction to finish. The information provided is limited and does not specify the exact nature of the vulnerability or its impact. The affected software versions are Microsoft products version 2.0 and 3.0. No CVSS score is available, and there are no known exploits in the wild. No patch or remediation details are provided in the available data.
CVE-2026-31568 is a vulnerability identified by the Microsoft Security Response Center related to missing secure storage access fixups for donated memory in the s390/mm component. The affected versions are specifically version 2.0 and 3.0 of the product. No CVSS score or detailed technical exploitation information is provided. There are no known exploits in the wild at this time.
CVE-2026-31575 is a vulnerability related to the calculation of the hugetlb fault mutex hash in Microsoft software versions 2.0 and 3.0. The provided information is limited and does not include technical details on exploitation or impact. No CVSS score is available for this vulnerability.
CVE-2026-31630 is a vulnerability identified in Microsoft products version 2.0 and 3.0 related to the rxrpc component's procedure for sizing address buffers for %pISpc output. The available information is limited and does not provide technical details beyond this. No CVSS score or detailed impact analysis is available.
CVE-2026-31489 is a vulnerability identified in Microsoft products version 2.0 and 3.0 related to the spi: meson-spicc component, specifically addressing a double-put issue in the remove path. The provided information is limited and does not include technical details about the nature of the vulnerability or its exploitation. No CVSS score is available, and no known exploits in the wild have been reported.
CVE-2026-31449 is a vulnerability related to the ext4 filesystem code, specifically involving validation of p_idx bounds in the ext4_ext_correct_indexes function. The affected product version is Microsoft 3.0. No CVSS score is provided, and there are no known exploits in the wild. No patch or remediation details are currently available.
This update for python313 fixes the following issues:
Update to version 3.13.13.
- CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to
misinterpretation of tar archives (bsc#1259611).
- CVE-2026-2297: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
- CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()` can lead to path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass
(bsc#1259734).
- CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
- CVE-2026-4519: failure to sanitize leading dashes in URLs in the `webbrowser.open()` API can lead to web browser
command line option injection (bsc#1260026).
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)
* kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in the Linux kernel's netfilter nf_tables subsystem involves improper handling of set element insertion when the set is full. This can lead to a race condition where an element is published and removed without waiting for the RCU grace period, potentially causing use-after-free issues. The issue is fixed by adding an element transaction even if the set is full and toggling a flag to safely unwind the set to its previous state. The vulnerability affects version 3.0 of the product.
A vulnerability identified as CVE-2026-23208 affects certain versions of Microsoft software related to ALSA usb-audio, where an excessive number of frames can be processed. The issue is documented with affected versions specified, but no detailed technical or impact information is provided. There is no information about active exploitation or patch availability.
A race condition vulnerability was identified in the ALSA aloop PCM trigger component of the Linux kernel. This issue was addressed in a security update that fixed multiple vulnerabilities across various Linux kernel subsystems. The vulnerability could potentially allow local attackers to escalate privileges or escape container environments. The fix is available and has been incorporated into updated Linux kernel releases.
A vulnerability identified as CVE-2026-23157 affects the BTRFS file system component in certain Linux kernel versions. The issue relates to the handling of metadata writepages without strictly requiring a dirty metadata threshold. Multiple Linux kernel subsystems, including BTRFS, were addressed in a security update released by Ubuntu. The vulnerability has medium severity and a patch is available. Users are advised to apply the kernel updates and reboot to ensure remediation.
A medium severity vulnerability identified as CVE-2026-23154 affects certain versions of the Linux kernel, involving a segmentation issue in forwarding fraglist GRO. This vulnerability is addressed by patches available in updated kernel versions. The issue is part of a broader set of security fixes released in the Linux kernel, which require system updates and reboots to apply. Users must recompile and reinstall third-party kernel modules due to ABI changes in the update.
A race condition vulnerability was identified in the netdevsim component related to operations on the bpf_bound_progs list. This issue affects multiple specific Linux kernel versions and could potentially lead to system compromise. The vulnerability has been addressed with an official patch. The vendor advisory from Ubuntu confirms the availability of fixes for this and other kernel vulnerabilities. No known exploits are currently reported in the wild.
A data-race warning and potential load/store tearing issue was identified in the rxrpc subsystem of the Linux kernel. This vulnerability affects multiple specific Linux kernel versions and could potentially be exploited to compromise system stability or security. The issue has been addressed by patches included in recent Linux kernel updates. Users are advised to apply these updates and reboot their systems to ensure the fixes take effect. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary after updating.