A vulnerability in the Linux kernel's ath11k WiFi driver was resolved by ensuring the 'num_stations' counter is reset properly on hardware restart. Without this fix, multiple hardware restarts could cause the driver to refuse new station or mesh peer associations, leading to connectivity issues and kernel warnings.
A vulnerability in the Linux kernel's RTC driver was resolved by zero-initializing the struct rtc_wkalrm to prevent information leakage. The issue involved uninitialized kernel stack data in padding holes of the struct being exposed to userspace via the RTC_WKALRM_RD ioctl call. This could lead to unintended disclosure of kernel memory contents. The vulnerability has been fixed by initializing the struct at declaration, eliminating the risk of leaking sensitive information.
A vulnerability in the Linux kernel IPv6 segment routing code (seg6_make_flowlabel) was resolved by using skb_get_hash_net() to properly obtain a network pointer. The issue arose when seg6_make_flowlabel() was called with an skb lacking both skb->dev and skb->sk pointers, which could occur in specific network scenarios involving TIPC UDP bearers and IPv4 routes with seg6 encapsulation enabled. This was fixed by ensuring the function uses skb_get_hash_net() to retrieve the network namespace pointer correctly.
A use-after-free vulnerability in the Linux kernel's EDAC altera driver was fixed. The issue occurred in error paths of altr_edac_a10_device_add() and altr_portb_setup() where a dci structure was freed before unregistering IRQ handlers, potentially allowing IRQs to access freed memory.
A NULL pointer dereference vulnerability in the Linux kernel's SPI-NAND driver was fixed. The issue occurs when the device tree sets "nand-no-ecc-engine", causing the ECC engine pointer to remain NULL while the code dereferences it unconditionally, leading to a kernel oops during device probing. The fix introduces a helper function to safely check the ECC engine pointer before use.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been resolved. The issue involved storing status information while holding a spinlock, which could cause faults due to writing into userspace. The fix changes the behavior to defer the status storage outside the spinlock context, preventing potential faults.
A vulnerability in the Linux kernel's MACsec driver was resolved by initializing the SecY component before registering the network device. The issue caused warnings and potential reporting of uninitialized SecY attributes during device registration, particularly when MAC offload was used over an LRO-capable lower device with IPv4 forwarding enabled. The fix involves reordering initialization steps to ensure SecY and related attributes are properly set before notifications are emitted.
A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) related to improper handling of the optional stream->sink pointer in DPMS sequences has been resolved. The issue involved dereferencing a potentially null pointer without proper checks, which could lead to inconsistencies or errors. The fix replaces usage of stream->sink->link with stream->link, adds assertions where sink is required, and improves resource access consistency.
A vulnerability in the Linux kernel's BPF sockmap implementation caused double-counting of the copied_seq TCP sequence number during self-redirects of packets back to the same socket. This led to warnings and potential TCP receive buffer inconsistencies. The issue was fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
A vulnerability in the Linux kernel's filesystem code caused hung tasks when unmounting filesystems after disk removal. The issue stemmed from repeated scans of inodes during eviction, which could block unmount operations and trigger hung-task reports. A patch was applied to change the inode eviction process to avoid repeated scanning and ensure proper inode disposal without blocking. Testing confirmed the fix resolves the issue without introducing regressions.
A vulnerability in the Linux kernel related to the parisc architecture has been resolved by increasing the kernel stack size to 32 KB for 64-bit kernels. This change addresses kernel crashes caused by kernel stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue manifested as kernel panics triggered by low stack detection in interrupt handlers.
A denial of service vulnerability exists in libexpat through version 2.9.0 related to delayed detection of the Billion Laughs attack pattern. This vulnerability can cause the software to become unresponsive or crash when processing specially crafted XML input. The affected version explicitly noted is version 3.0 of the Microsoft product referencing libexpat. No CVSS score or detailed impact metrics are provided.
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.
This vulnerability affects Node.js **26.x**.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).
`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.
This vulnerability affects Node.js **26.x** and **24.x**.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.