A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) has been resolved. The issue involves rebinding an HCI socket after its controller is unregistered, which can lead to a kernel crash due to a NULL pointer dereference or use-after-free. The root cause is missing serialization when detaching dead devices, allowing concurrent access to freed or nullified device pointers.
A concurrency vulnerability in the Linux kernel Bluetooth ISO socket connect function (iso_sock_connect) has been resolved. The flaw allowed concurrent connect calls to bypass socket state checks, potentially leading to use-after-free conditions due to race conditions in connection setup and teardown. The fix serializes concurrent connect calls by marking the connect operation in progress and rejecting concurrent attempts until completion. This prevents destination overwrites and stranded connection references.
A vulnerability in the Linux kernel Bluetooth RFCOMM implementation causes a memory leak when the data link connection (DLC) has no owner. Specifically, the skb (socket buffer) is not freed in certain conditions, leading to resource leakage. This occurs because the socket implementation does not free the skb when the DLC owner is cleared, unlike the tty implementation which does. The leak can grow indefinitely while the remote device continues sending data.
A locking order vulnerability in the Linux kernel's Bluetooth RFCOMM implementation (CVE-2026-99009) has been resolved. The issue involves a circular locking dependency between rfcomm_mutex and hdev->lock during RFCOMM socket connection and HCI event handling, which can cause lockdep warnings and potential deadlocks. The fix changes the order of locking by connecting the session socket before acquiring rfcomm_mutex, eliminating the circular dependency. Additional safeguards were added to handle race conditions where sockets or DLCs might be closed during connection setup.
A NULL pointer dereference vulnerability in the Linux kernel Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown() function when closing an RFCOMM tty device. If the tty device registration fails, a NULL pointer dereference can happen because the code does not check if the tty device pointer is NULL before using it. This can lead to a kernel crash (general protection fault). The fix adds a NULL check to prevent this dereference.
A vulnerability in the Linux kernel's drm/fb-helper component was resolved. The issue involved improper handling of failures in drm_fb_helper_single_fb_probe(), where failures other than -EAGAIN did not mark the fb_helper for deferred setup. This caused stale mode_set configurations to be committed later, triggering warnings. The fix ensures deferred setup is marked on any failure, preventing stale commits until a successful re-probe occurs.
A vulnerability in the Linux kernel's drm/i915/gem component could cause improper memory cleanup by overstepping the exec array boundary during relocation parsing. This occurs when the function eb_relocate_parse_slow() calls kvfree() on entries beyond the original exec array due to an incremented buffer count that includes appended VMAs. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
A race condition vulnerability in the Linux kernel's i915 DRM driver was resolved by ensuring interrupts are only unmasked when the RPS (Render Power State) is active. The flaw involved a timing window where interrupts could be unmasked after the GPU was parked and the runtime power management wakelock was dropped, causing kernel taint due to hardware access without the wakelock held.
A vulnerability in the Linux kernel's drm/vmwgfx component was resolved by validating the pitch value received from userspace along with box dimensions before copying data. This fix addresses potential out-of-bounds reads that could occur during cursor snooping.
A vulnerability in the Linux kernel's mount propagation logic allowed synchronous unmount operations to succeed even when the mount was still in use. This was due to propagate_mount_busy() not properly checking certain mount copies with children, leading to mounts being silently unmounted while still referenced. The flaw could affect container environments sharing mount trees with the host, causing mounts to be detached unexpectedly.
A vulnerability in the Linux kernel's namespace handling was resolved by preventing the MNT_UMOUNT flag from being inherited in clone_mnt(). The issue involved mounts that were lazily unmounted but kept alive by file descriptors still being copied with the MNT_UMOUNT flag set, causing multiple bugs including mount namespace leaks, improper unmount behavior, and corrupted mount propagation. The fix adds MNT_UMOUNT to internal flags so it is not copied during cloning, preventing these issues.
A vulnerability in the Linux kernel's namespace handling has been resolved. The issue involves the may_copy_tree() function accepting mounts whose roots are nsfs or pidfs files before verifying if the mount is actually mounted. This allowed recursive copying of unmounted mount trees, which is unintended behavior. The fix prevents walking an unmounted tree during recursive copy operations, causing such attempts to fail with EINVAL. Bind mounting a namespace that is gone remains possible if pinned by a file descriptor.
A vulnerability in the Linux kernel related to namespace handling and unmounting submounts has been resolved. The issue involves the unmounting process where busy mounts may be incorrectly unmounted due to improper reference checks, potentially leading to mounts being marked as synchronously unmounted while still in use. This affects mounts with the MNT_SHRINKABLE flag, such as automounted submounts of NFS, AFS, CIFS, and certain debugfs mounts. The fix ensures that each mount is checked for references right before unmounting under appropriate locks to maintain correctness.
A vulnerability in the Linux kernel's mount namespace handling allows recursive bind mounts of mount namespace files, which can cause cycles and unlimited resource leaks. The issue arises because the kernel does not fully check for mount namespace loops when performing recursive bind mounts with MS_REC, allowing a process to create a bind-mount stack of mount namespace file descriptors that leaks kernel memory.
An integer overflow or wraparound vulnerability has been identified in GitLab version 3.0. This type of vulnerability can lead to unexpected behavior in software when integer calculations exceed their maximum value and wrap around, potentially causing security issues.
An integer overflow or wraparound vulnerability has been identified in GitLab version 3.0. This type of vulnerability involves improper handling of integer values, which can lead to unexpected behavior in software. No CVSS score or detailed technical impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
A vulnerability identified as CVE-2026-112085 affects webpack-dev-server version 3.0, allowing cross-origin WebSocket access via proxied upgrades. This issue relates to improper handling of WebSocket upgrade requests that could enable unauthorized cross-origin access. No CVSS score is provided, and there is no indication of known exploits in the wild. No patch or remediation details are currently available.
CVE-2026-91403 is a vulnerability affecting Microsoft product version 3.0. The description references Microsoft Support Lifecycle information but does not provide specific technical details about the vulnerability. No CVSS score or detailed impact information is available.
A vulnerability identified as CVE-2026-111181 affects the body-parser component version 3.0, allowing a Denial of Service (DoS) attack via trailing bytes after a compressed request body. The issue relates to improper handling of compressed request bodies that contain extra trailing bytes, which can be exploited to disrupt service availability.
A vulnerability in Node.js HTTP Agent connection reuse can cause a client to accept a response that was sent before, potentially leading to incorrect or unexpected behavior. This flaw relates to improper handling of HTTP connection reuse in the affected version 3.0 of the product. No CVSS score or detailed impact information is provided.