CVE-2026-43842 is a NULL pointer dereference vulnerability in the license manager service of Advantech ADAM-3600 devices. An unauthenticated attacker can trigger a crash of the service by sending a message with a length of zero to the rpc_rx_fsm function. This vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-43841 is a NULL pointer dereference vulnerability in the license manager service of Advantech ADAM-3600 devices. This flaw allows an unauthenticated attacker to cause the service to crash by exploiting the rpc_rx_fsm function. The vulnerability has a medium severity rating with a CVSS score of 6.9. No affected versions or patches have been specified in the available data.
ArmorX Spam by ArmorX Global Technology contains a command injection vulnerability (CWE-93) that allows authenticated remote attackers to inject crafted commands into a parameter, enabling malicious code upload to the server. This vulnerability affects versions prior to 8.15.2-3.282.133-1.90.061. It has a high severity rating with a CVSS score of 7.1. A fixed version 8.15.2-3.282.133-1.90.061 is available.
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
CVE-2026-98795 is a vulnerability related to the net: sparx5 component in Microsoft software versions 3.0 and 4.0. The issue involves skipping the PTP deinitialization if the initialization was skipped. No CVSS score or detailed impact information is provided.
A vulnerability identified as CVE-2026-98575 affects the NFC pn533 driver in Microsoft products. The issue involves an out-of-bounds (OOB) read in the function pn533_acr122_is_rx_frame_valid(). The affected versions are 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild. No patch or remediation details are available in the provided data.
CVE-2026-77684 is a denial-of-service vulnerability in the Bluetooth Classic Hands-Free Profile (HFP) HF role implementation in Zephyr OS versions 4.2.0 through 4.4.2. The flaw occurs because AT command buffers queued for transmission are not released when the RFCOMM data link connection goes down, leading to exhaustion of a fixed buffer pool. This causes permanent failure in sending HFP commands and can halt the Bluetooth RX thread, requiring a device reboot. The issue requires an established HFP session and a build with CONFIG_BT_HFP_HF enabled.
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.
At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.
A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
A use-after-free vulnerability in the Linux kernel's BPF subsystem was resolved by ensuring a reference to the map BTF is held during memory allocator destructor operations. The flaw involved premature freeing of BTF data while deferred workqueue tasks still accessed it, leading to kernel memory corruption detected by KASAN.
A NULL pointer dereference vulnerability in the Linux kernel's bcmgenet network driver was fixed. The issue occurs when setting Rx coalescing parameters on an interface that has not been opened, causing a NULL dereference and kernel oops. This results in networking becoming unresponsive until a reboot. The fix involves initializing necessary private data structures at probe time to prevent the NULL dereference.
A vulnerability in the Linux kernel's stmmac network driver related to RX Scatter-Gather support has been resolved. The issue occurs when a received frame larger than the DMA buffer size is scattered across multiple RX descriptors, but the secondary RX buffer was not properly allocated or mapped for regular frames. This causes DMA to write to an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. The fix enables scatter-gather support for non-split-header frames on capable cores by properly allocating and validating the secondary buffer and adjusting buffer length computations. Some related cases, such as AF_XDP zero-copy RX, remain unaddressed and are planned for future fixes.
A null pointer dereference vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown has been fixed. The issue occurs during teardown of the XSK TX queue when outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code dereferences a null CQE pointer, causing a potential crash. The fix returns zero when no CQE is available, preventing the null dereference.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem related to RX Block Acknowledgement (BA) session teardown has been resolved. The issue involves a session timer being left queued on freed memory, leading to potential timer callbacks running against freed tid_rx structures. This occurs because the RX BAR handler can access tid_rx under RCU before it is unpublished, allowing stale handlers to rearm timers after deletion synchronization. The fix involves using timer_shutdown_sync() to prevent timer rearming once teardown begins.
A vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) component has been resolved. The issue involved improper reference counting on interrupts referenced by last_lr_irq, which could vanish if a concurrently unmapped LPI (Locality-specific Peripheral Interrupt) occurred. The fix involves incrementing the reference count when populating last_lr_irq and decrementing it during LPI reclamation.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem allowed proxy-path churn to cause the interface path counter to become negative, bypassing the mesh path limit (MESH_MAX_MPATHS). This flaw could let mesh path additions exceed the intended maximum. The issue was due to improper accounting of proxy paths against the shared mesh path quota. The vulnerability has been resolved by ensuring proxy paths reserve quota slots and share a 1024-entry budget with mesh paths.
A vulnerability in the Linux kernel's Thunderbolt driver was resolved that involved accessing a DisplayPort (DP) tunnel after its DPRX read operation was canceled. The issue occurred because the code checked a cancellation flag without proper locking, allowing a callback to run on a tunnel that had already been torn down during system suspend or shutdown. This could lead to improper handling of the DP tunnel state.
A vulnerability in the Linux kernel's Thunderbolt driver caused a domain reference leak when a DisplayPort (DP) receiver (DPRX) read operation was canceled. This leak could block driver unbinding indefinitely due to a completion wait that never finishes. The issue arises when a DP tunnel is torn down before the DPRX read completes, such as unplugging within a timeout period. The fix involves changing the ownership of the domain reference to the work itself, ensuring proper reference counting and preventing leaks or hangs during driver removal.
A vulnerability in the Linux kernel's BPF subsystem involving the __htab_map_lookup_and_delete_batch() function could cause a soft lockup on systems with many CPUs and large hash maps. The issue arises because the function lacks rescheduling points during batch operations, leading to prolonged CPU occupancy and triggering the soft lockup watchdog. This has been fixed by adding rescheduling points to avoid long CPU hold times during batch lookups and deletions.