The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.
The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.
On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.
The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_start_add_conn() in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, find_pending_connect() in subsys/bluetooth/host/hci_core.c looked that reservation up using only the identity and the peer address, with a directed-then-undirected fallback, and had no knowledge of which advertising set actually terminated. With CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1, where the LE Enhanced Connection Complete event is cached until the LE Advertising Set Terminated event identifies the set, this lookup can return the reservation belonging to a different, still-running advertising set.
The defect is reachable over the air by any adjacent device. If an application runs two connectable extended advertising sets on the same identity — one undirected and one directed at a peer P (the common "directed reconnect to a bonded central while still accepting new centrals" pattern) — a remote initiator whose address maps to P connecting on the undirected set causes the directed set's reservation to be consumed instead. The initiator address is chosen freely by the remote device and is not authenticated at link establishment, so no bonding, pairing or prior relationship is required to trigger the mis-attribution.
The undirected set's own reservation is then stranded: its BT_ADV_ENABLED flag has already been cleared, and le_adv_stop_free_conn() — the only path that returns a reservation to the pool — is reached only for sets that are still enabled, so bt_le_ext_adv_stop() returns early and the object is never released. Each occurrence permanently consumes one CONFIG_BT_MAX_CONN slot until bt_disable() or reboot. In application patterns that restart the directed advertising set after each disconnect, an attacker can repeat the sequence until the pool is exhausted, after which connectable advertising fails with -ENOMEM and the device can no longer accept connections. As a side effect the directed set keeps advertising without a reservation, so a genuine connection on it is dropped by bt_hci_disconnect(). The impact is availability only; no memory corruption or information disclosure results, and configurations with a single advertising set are unaffected.
CVE-2026-116369 is an OS command injection vulnerability in Sunwood-ai-labs github-kanban-mcp-server versions up to 0.4.0. The flaw exists in the handleListIssues function of src/handlers/issue-handlers.ts, where manipulation of the state or labels argument can lead to command injection. The vulnerability can be exploited remotely. Upgrading to version 0.4.1 addresses this issue.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.
Mattermost versions 11.7.0 through 11.7.10 contain an authorization flaw where the API does not properly restrict which built-in roles a team admin can assign to team members. This allows a team admin to grant permissions beyond the configured permission scheme via the update-team-member-roles REST API endpoint. The vulnerability has a low severity rating with limited impact on confidentiality and integrity.
Syncplify Server! versions prior to 8.8.0 contain a path traversal vulnerability due to improper link resolution before file access. This flaw allows attackers who can place symbolic links or directory junctions inside a user's home folder to access files outside the intended virtual filesystem root. The vulnerability arises because confinement checks are performed on the requested path rather than the actual on-disk target of the link, enabling unauthorized file access beyond the home-folder boundary.
Syncplify Server! versions prior to 8.8.0 have an access control bypass vulnerability due to improper resolution of path equivalence. Authenticated SFTP users can bypass per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names, allowing unauthorized file uploads and downloads. This vulnerability is fixed in version 8.8.0.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 9.6 Extended Update Support. These include denial of service, arbitrary code execution via various buffer overflow and use-after-free flaws, data integrity issues due to integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update synchronizes release versions across several RHEL releases and addresses these critical security issues.
CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
A heap buffer overflow vulnerability exists in the RainerScript replace() function of the rsyslog daemon, which can lead to a denial of service condition. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security update to address this vulnerability.
CVE-2026-116368 is an improper authorization vulnerability in DeepSeek Harness versions 0.2.0-rc.0 through 0.2.0-rc.2. It affects the Browser Auth component, specifically in the file packages/client/connection/src/browser-auth.ts. The flaw allows remote attackers to bypass authorization controls. The vendor has not responded to disclosure attempts, and no patch or fix is currently available.
A buffer overflow vulnerability in the Linux kernel's dm-integrity inline mode with large tag sizes has been fixed. The issue occurs because checksum computations use a buffer smaller than the tag size, causing overflow and kernel panic with stack protection enabled. This overflow can only be triggered by root, so it is not considered a security bug.
A vulnerability in the Linux kernel's drm/vc4 driver involves improper handling of the hangcheck timer and job completion work during V3D unbind. The hangcheck timer and job_done_work are not properly stopped or drained before the V3D interrupt is uninstalled and the associated device structure freed. This can lead to timer callbacks accessing freed memory, causing potential use-after-free conditions.
A vulnerability in the Linux kernel related to AMD processors' TLB invalidation has been addressed. The issue involves the processor potentially failing to invalidate a TLB entry when executing an INVLPGB/TLBSYNC instruction pair. A software workaround is applied when a microcode fix is not available to mitigate this erratum.
A vulnerability in the Linux kernel's RISC-V architecture handling of BPF JIT execmem addresses was fixed. The issue involved incorrect assumptions about memory writability in the vmalloc area when CONFIG_STRICT_MODULE_RWX is disabled, causing BPF JIT compilation to fail due to page faults. This bug affects configurations where BPF text is read-only regardless of strict module RWX settings and can prevent BPF programs from being JIT-compiled. The fix aligns with similar corrections made on arm64 and involves proper handling of executable memory mappings in patch_map(). The vulnerability does not affect !CONFIG_MMU builds.
A vulnerability in the Linux kernel's memory management subsystem causes a kernel panic during boot when using a boot-time function tracer with a specific filter. The issue arises because deferred kernel page table freeing is scheduled before the workqueue system is initialized, leading to a null pointer dereference and system crash. The flaw was introduced by a commit that allowed collapsing page tables to free kernel page tables prematurely during early boot. The fix prevents scheduling deferred freeing work while the system is still booting, deferring it until the workqueue is available.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed by correcting a bounds check on the TX descriptor index. The function btintel_pcie_prepare_tx() previously allowed an index equal to the array size, which is out of bounds, potentially leading to memory access errors.
A vulnerability in the Linux kernel Bluetooth management subsystem caused pending commands flushed on power off to report incorrect success status instead of the actual error status. This could lead to user-space components like bluetoothd misinterpreting the device state, potentially causing crashes.