CVE-2026-67242 is a medium severity vulnerability in rabbitmq-server affecting versions from 4.2.0 up to but not including 4.2.9 and from 4.3.0 up to but not including 4.3.3. The issue arises because the OAuth2 token expiry validation incorrectly skips checks when the token's 'exp' claim is a floating-point number rather than an integer. This allows an attacker with a previously valid signed token containing a float 'exp' value to bypass expiry checks, causing the server to accept expired tokens and maintain connections indefinitely. The vulnerability is fixed in versions 4.2.9 and 4.3.3.
CVE-2026-100248 is a high-severity vulnerability in the Rattadan Cosmowarp smart contract before commit 56c6147. It involves an incorrect comparison operation using the current_admin value, which may lead to unintended behavior in the contract's access control or logic.
CVE-2026-67225 is a medium severity vulnerability in rabbitmq-server affecting versions 3.13.0 through 3.13.14, 4.0.0 through 4.0.19, 4.1.0 through 4.1.10, and 4.2.0 through 4.2.5. The issue involves the stream protocol storing the FrameMax value negotiated during the Tune handshake but failing to validate inbound frame lengths against this value. This allows a remote client to cause excessive memory consumption and potentially a denial of service when the stream plugin is enabled. The vulnerability is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use, and setting auth_mechanism requires the policymaker tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVE-2026-98111 is a high-severity vulnerability in the Linux kernel's Bluetooth subsystem (btintel). It involves improper validation of version TLV (Type-Length-Value) data lengths, which can lead to out-of-bounds reads. The flaw arises because the function btintel_parse_version_tlv() does not verify that the value length matches the expected size for each TLV type, potentially causing memory safety issues.
CVE-2026-97554 is a vulnerability in the Linux kernel SMB client where uninitialized Security Identifiers (SIDs) may be used in the cifs_posix_to_fattr() function. This occurs because the function ignores the failure return value of posix_info_parse(), leading to potential leakage of kernel stack memory to userspace when parsing malformed POSIX directory entries from untrusted servers. The issue is fixed by checking the return value and skipping SID-to-id mapping on parse failure.
A vulnerability in the Linux kernel's qla2xxx SCSI driver causes a CPU soft lockup due to an infinite polling loop triggered by misinterpreting certain Fibre Channel frame payloads. This occurs because the driver spins waiting for a signature value that can be falsely matched by payload data, leading to a hang in interrupt context. The issue has been fixed by removing the problematic polling and relying on safer checks to detect continuation IOCBs.
A vulnerability in the Linux kernel's XFS filesystem code was resolved involving an uninitialized error variable in the function xfs_defer_finish_one(). This flaw causes the function to return an indeterminate value when a certain list is empty, which can lead to a false error during online repair operations. The incorrect error handling may cause a successful barrier operation to be treated as a fatal error, resulting in a SHUTDOWN_CORRUPT_INCORE state during repair.
A vulnerability in the Linux kernel SMB1 client allows a malicious or compromised SMB1 server to cause out-of-bounds reads in the CIFSSMBRead() function by providing a crafted DataOffset value. This can lead to information disclosure or denial of service. The issue arises because DataOffset is not validated against the response length, allowing memcpy() to read beyond the buffer. SMB1 is not negotiated by default, requiring explicit use of vers=1.0 mount to reach the vulnerable code. The vulnerability has been resolved by adding proper validation to ensure DataOffset and DataLength fit within the response buffer.
A vulnerability in the Linux kernel's bnxt_en driver was resolved involving improper handling of buffer allocation failures in the bnxt_queue_mem_alloc() function. The issue occurs when bnxt_alloc_one_tpa_info_data() returns an error due to allocation failure, but bnxt_queue_mem_alloc() ignores this error and installs a partially initialized ring. This can lead to the hardware selecting an uninitialized slot with a zero DMA address, potentially causing malfunction. The fix involves checking the allocation return value and properly freeing resources on failure.
A vulnerability in the Linux kernel's netfs component was fixed where an uninitialized return value in netfs_unbuffered_write() could cause incorrect error reporting during synchronous writes. This occurs if preparation of the first subrequest fails, such as through CIFS when cifs_prepare_write() fails to reopen the file or obtain credits. The fix initializes the return value to ensure the caller receives the correct error or byte count.
A vulnerability in the Linux kernel's ethosu accelerator driver was fixed by correcting the return value handling in the ethosu_job_open() function. The issue involved improper use of WARN_ON(), which returns 0 or 1 instead of a negative error code, potentially causing incorrect error reporting. The fix drops WARN_ON() to allow the file descriptor open operation to properly pass the error code to userspace. This vulnerability affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel watchdog driver for msc313e was resolved. The issue involved the msc313e_wdt_settimeout() function unconditionally calling msc313e_wdt_start(), causing two bugs: an unbalanced clock reference count when the watchdog is already active, and accidental starting of the hardware timer when the watchdog is stopped. The fix involved refactoring the register-writing logic to only start the timer if the watchdog is running, otherwise just updating the timeout value.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie was resolved. The issue involved the function btintel_pcie_submit_rx_work() reading a packet length value without validating if it exceeded the receive buffer size, potentially causing an out-of-bounds read. The fix adds validation to ensure the packet length is non-zero and does not exceed the buffer size, logging an error if invalid. This vulnerability affects specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's ethernet cortina driver was fixed by correcting the gmac_rx() function's return value handling. The function previously returned the remaining NAPI budget, but its caller misinterpreted this as the number of packets received, causing an idle poll to report a full budget and remain scheduled unnecessarily. The fix returns the actual number of received packets and adjusts the free queue refill accounting accordingly.
A vulnerability in the Linux kernel's vduse component caused incorrect handling of compat ioctl results, leading to file descriptor leaks. The issue arises because the compat handler processes certain ioctl commands but then calls the native handler, which returns an error that overwrites the intended return value, resulting in leaking one file descriptor per call. This has been resolved by returning handled compat results directly and only using native dispatch for other commands.
A vulnerability in the Linux kernel's vduse component allows invalid virtqueue alignment values to reach critical functions, potentially causing null pointer dereferences and kernel crashes. The issue arises because vduse_validate_config() only checks the upper bound of the alignment value, permitting zero or non-power-of-two values that violate the VIRTIO specification. This can lead to kernel memory corruption and system instability when opening virtio-net devices with improper alignment.
A vulnerability in the Linux kernel's vdpa_sim_net component was resolved. The issue involved improper handling of the TX pull result before using it in the RX copy path, where a negative error value was incorrectly treated as a large unsigned length. This could lead to incorrect memory operations. The vulnerability has a CVSS score of 7.5 and affects specific versions of the linux-hwe-edge kernel.