CVE-2026-114354 is a high-severity vulnerability in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. It involves missing authorization in the native binder service 'android.dji.server' (transaction code 1018), allowing a local application without permissions to execute arbitrary OS commands as root. This occurs because the handler passes a caller-supplied string to the root-privileged 'assistant' daemon's system() call without verifying caller identity or permissions.
CVE-2026-99009 is a Linux kernel vulnerability in the Bluetooth RFCOMM subsystem involving improper locking order during session socket connection. The flaw causes a circular locking dependency between rfcomm_mutex and hdev->lock, which can lead to lockdep warnings and potential race conditions. The issue arises when an RFCOMM connect() call is made while a BR/EDR link is authenticating, resulting in inconsistent lock acquisition order. The fix involves changing the connection sequence to connect the session socket before acquiring rfcomm_mutex, eliminating the circular dependency and handling edge cases where sockets or DLCs may be closed during connection.
A vulnerability in the Linux kernel's ibmveth driver was fixed involving improper cleanup of logical LAN resources on failure during the open process. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource mismanagement. The fix moves the cleanup call to a shared post-register unwind path to ensure proper deregistration in all failure cases.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but the pwrseq-pcie-m2.c code did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.
CVE-2026-99018 is a high-severity vulnerability in the Linux kernel affecting the RISC-V architecture under CONFIG_SHADOW_CALL_STACK. The kernel incorrectly determines whether a trap came from userspace by comparing a user-writable register (tp) instead of using the hardware sstatus.SPP bit. This flaw allows an unprivileged user to manipulate the shadow call stack pointer, enabling arbitrary kernel memory write and control-flow hijacking. The issue is fixed by changing the check to rely on the hardware-controlled sstatus.SPP bit, which cannot be forged by user mode.
A vulnerability in the Linux kernel's unshare system call could cause active namespace references to be dropped incorrectly when set_cred_ucounts() fails during unshare. This leads to namespace reference counts going negative and the caller losing references to namespaces it continues to use, causing those namespaces to no longer appear in namespace listings. The issue affects multiple Linux kernel versions and has been fixed in later releases.
A vulnerability in the Linux kernel's RTC device driver allows uninitialized kernel stack data to be leaked to userspace due to padding holes in the rtc_wkalrm structure. This occurs when the structure is returned via the RTC_WKALRM_RD ioctl call. The issue is resolved by zero-initializing the struct at declaration to prevent information leakage.
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
A vulnerability in the Linux kernel's network bridge code involved a stale rcu_barrier() call in the br_multicast_dev_del() function. This call was a remnant from earlier code using call_rcu() and caused excessive RTNL (routing netlink) pressure, leading to blocked tasks and potential performance degradation. The issue has been resolved by removing the obsolete rcu_barrier() call, which is no longer necessary due to the use of kfree_rcu().
A vulnerability in the Linux kernel's ntfs3 driver related to improper handling of set_blocksize failures has been resolved. The issue arises because ntfs3 uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly, leading to a kernel BUG_ON during mounting. This bug triggers in folio_set_bh on the first __bread_gfp call. The vulnerability affects Linux kernel version 5.15 and has been fixed in specific commits.
A vulnerability in the Linux kernel's isofs filesystem driver related to handling set_blocksize failures has been resolved. The issue arises because isofs uses buffer_heads, which do not properly handle block sizes larger than PAGE_SIZE. Without proper handling, mounting an isofs filesystem can trigger a kernel BUG_ON condition in folio_set_bh during the first __bread_gfp call. This flaw was fixed in specific Linux kernel commits.
A vulnerability in EmberZNet 9.1.1 and earlier allows a malformed Publish Billing Period command from a device that has joined the network and supports the Price Cluster to trigger a recursive function call without an end condition. This can cause a denial of service due to resource exhaustion.