CVE-2026-78164 is a high-severity vulnerability in Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components. It involves improper neutralization of special elements used in a template engine, allowing inbound messages to override endpoint URIs via headers that are processed through a property-placeholder resolution mechanism. This can lead to exposure of sensitive information and unintended configuration or bean method invocation. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, with 4.23.0 recommended for the latest fixes. Mitigations include upgrading to fixed versions or stripping override headers at the trust boundary, or setting skipControlHeaders=true on camel-http endpoints. The vulnerability is not mitigated by bridgeEndpoint=true or percent-encoding placeholder delimiters.
CVE-2026-78163 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability arises because the DoclingProducer interprets message body prefixes to decide how to process them, allowing untrusted input to trigger remote URL fetches or local file reads without explicit configuration. This implicit mode selection can lead to unauthorized access to remote or local resources. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1. Users unable to upgrade immediately should avoid routing external message bodies into Docling endpoints or use typed bodies or headers to prevent prefix interpretation.
CVE-2026-78162 is a critical deserialization of untrusted data vulnerability in Apache Camel affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw arises because certain Hazelcast instances created internally by Camel do not apply Java deserialization filters, allowing an attacker with access to the Hazelcast cluster to cause arbitrary Java objects to be deserialized. This can lead to remote code execution. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1, and users are strongly advised to upgrade. Alternative mitigations include supplying explicit Hazelcast configurations with deserialization filters, injecting pre-built Hazelcast instances, setting JVM-wide serialization filters, and enabling Hazelcast cluster authentication and TLS.
A security vulnerability has been identified in michaelrsweet mxml version 4.0.5 and several other specific versions. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires network access with low attack complexity and privileges, and user interaction is needed. The impact includes limited confidentiality, integrity, and availability losses. No public exploit or known active exploitation has been reported. The affected versions include multiple specific builds from 2.7-1 through 4.0.4-6.
CVE-2026-98866 is a use-after-free vulnerability in the Linux kernel scheduler related to the sched_cache_grp pointer in task_struct. The flaw was addressed by introducing a dedicated sched_cache_grp pointer in each task_struct to decouple scheduler hot-path accesses from the mm_struct, preventing use-after-free conditions during memory management transitions such as fork and exec. This fix involves reference counting changes and scheduler code updates to safely manage cache group references.
CVE-2026-98865 is a vulnerability in the Linux kernel's sched_ext component where ops.dequeue() is called while holding a DSQ lock, leading to potential self-deadlocks in BPF schedulers. The issue arises because ops.dequeue() is invoked with the source user DSQ's lock still held on certain paths, causing recursion lock dependency checks to fail. The flaw has been addressed by moving the ops.dequeue() call after the DSQ unlock on all affected paths, ensuring the callback is invoked exactly once.
CVE-2026-98864 is a medium severity vulnerability in the Linux kernel scheduler extension (sched_ext) where a task can be re-enqueued prematurely due to improper waiting for the SCX_OPSS_DISPATCHING state to clear. This flaw could cause the dispatcher's final state update to overwrite the queued state, resulting in dropped dispatches of the task. The issue affects multiple specific Linux kernel versions, including various 4.15.x, 5.0.x, and 5.3.x builds. The vulnerability has been addressed by ensuring the scheduler waits for SCX_OPSS_DISPATCHING to clear before re-enqueueing tasks, aligning with the behavior in ops_dequeue().
CVE-2026-98832 is a medium-severity vulnerability in the Linux kernel's blk-cgroup subsystem related to improper handling of interrupt (IRQ) state in the blkg_tryget_closest() function. The flaw involves enabling local interrupts unconditionally when releasing a spinlock, which can lead to deadlocks if interrupts were already disabled by the caller. This issue affects certain Linux kernel versions used in various Ubuntu LTS releases.
A medium severity vulnerability in the Linux kernel's BPF subsystem was fixed by adding missing migration protection in the __rhtab_map_lookup_and_delete_batch() function. The issue involved the use of this_cpu_ptr() without disabling CPU migration, which could cause a kernel BUG due to smp_processor_id() being used in preemptible code. The fix wraps the delete loop with migrate_disable()/migrate_enable() to prevent task migration during the operation.
A use-after-free vulnerability exists in the Linux kernel's HID winwing driver related to force feedback teardown. The issue arises because the driver's private data, allocated with devm_kzalloc(), is incorrectly freed twice: once by the force-feedback core and again by the device resource management, causing memory corruption. This can occur during device unbind, module removal, hot-unplug, or system suspend operations.
A vulnerability in the Linux kernel's BPF verifier regsafe() function allows unsound handling of packet pointer class displacement. This flaw can lead to out-of-bounds packet access due to improper preservation of displacement between registers sharing a packet pointer ID. The issue affects specific Linux kernel versions and has been resolved by requiring matching range bases for packet pointers with an ID.
CVE-2026-98619 is a high-severity vulnerability in the Linux kernel's ethtool component related to improper locking during the ioctl self test. The issue arises because the ETHTOOL_TEST ioctl runs holding only the netdev instance lock instead of the required rtnl_lock, causing the device to be torn down and brought back up without proper synchronization. This can lead to warnings or assertion failures in kernel locking checks and potential device misconfiguration during the self test. The vulnerability affects specific Linux kernel versions used in various Ubuntu LTS releases.
A vulnerability in the Linux kernel Bluetooth RFCOMM implementation allows short EA=0 frames to be incorrectly processed due to insufficient length checks in the rfcomm_recv_frame() function. This flaw could lead to malformed frames being treated as valid payload or control commands, potentially causing unexpected behavior.
A vulnerability in the Linux kernel firewire cdev subsystem caused an incorrect state transition in the iso_resource_auto client resource. Concurrent access could cause the state to revert backwards, potentially leading to inconsistent resource management. This issue has been fixed by adding checks to prevent the back-transition.
CVE-2026-98557 is a medium severity vulnerability in the Linux kernel's gve driver related to incorrect header length calculation for UDP Generic Segmentation Offload (GSO) packets. The function gve_can_send_tso() incorrectly uses TCP header length for UDP packets, causing miscalculation of segment boundaries. This can lead to either unnecessary disabling of GSO or handing the device packets that exceed buffer limits. The issue affects specific Linux kernel versions and has been resolved by correctly using the UDP header length for SKB_GSO_UDP_L4 packets.
A vulnerability in the Linux kernel's fprobe feature causes improper termination of the fgraph_data list when a reservation is not filled. This can lead to an exit handler running twice or running despite being skipped by its entry handler. The issue arises because reserved shadow stack space is not cleared, causing fprobe_return() to misinterpret unused data. The fix involves writing a zero word after the last entry to properly terminate the list and adjusting the header decoding to handle zeroed slots correctly.
CVE-2026-98500 is a medium severity vulnerability in the Linux kernel's HID subsystem (hid-oxp driver). The issue arises because the remove function uses cancel_delayed_work() which only dequeues pending work without waiting for ongoing callbacks to finish. This can lead to concurrent access to a HID device after it has been closed and stopped, potentially causing undefined behavior. The fix involves using cancel_delayed_work_sync() to ensure any in-progress work completes before device teardown.
CVE-2026-98719 is a vulnerability in the Linux kernel's KVM SEV implementation involving improper handling of the "have run CPUs" mask pointer during freeing. The flaw can cause a double-free condition if the mask is freed twice, particularly when __sev_guest_init() fails. This issue has been addressed by nullifying the pointer when freeing the mask and adding helper functions to manage allocation and freeing safely.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper cache maintenance timing during intra-host VM migration. The issue arises because cache flushes are performed after clearing the SEV active state on the source VM, creating a small window where memory reclaim operations may incorrectly skip cache flushes. This can lead to stale or incorrect memory data being exposed to the host or other VMs.
A NULL pointer dereference vulnerability in the Linux kernel's Thunderbolt subsystem was fixed in the tb_remove_work() function. The issue arises due to a race condition between tb_remove_work() and tb_domain_remove(), leading to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains(). This can cause kernel instability or crashes. The fix involves ensuring proper locking and checks around tb->root_switch to prevent the NULL dereference.