In the Linux kernel, the following vulnerability has been resolved:
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
memstick_check() can pass its host->removing check just before
rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then
silently dropped: rtsx_usb_ms_request() skips schedule_work() once eject
is set, and drv_remove's cancel_work_sync() can also cancel a queued
handle_req before it picks the request up. Nobody completes
card->mrq_complete.
Once memstick core waits for requests without a timeout ("memstick: core:
wait for request completion before freeing card"), this hangs removal:
memstick_check() never returns and memstick_remove_host() blocks in
flush_workqueue():
INFO: task kworker/u10:3:65 blocked for more than 20 seconds.
Workqueue: kmemstick memstick_check
__wait_for_common
memstick_check
INFO: task kworker/1:1:33 blocked for more than 20 seconds.
Workqueue: usb_hub_wq hub_event
__flush_workqueue
memstick_remove_host
rtsx_usb_ms_drv_remove
Never drop a request. rtsx_usb_ms_request() always schedules handle_req,
and handle_req fails requests with -ENOMEDIUM once eject is set, without
touching the device. drv_remove flushes handle_req instead of cancelling
it, and cancels it only after memstick_remove_host(), when no new
request can arrive, so it cannot run on a freed host.
The host_mutex drain in drv_remove is removed: handle_req always leaves
host->req NULL when it finishes, so the drain never had anything to do,
and it would now race with handle_req.
CVE-2026-99039 is a use-after-free vulnerability in the Linux kernel's memstick subsystem. It occurs because the subsystem frees the memstick_dev structure after a timeout without aborting in-flight asynchronous requests, leading to writes to freed memory. This flaw was fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure requests complete before freeing memory.
Multiple threat actors have been abusing the open source AI platform Cairn to automate attacks against hundreds of organizations worldwide. These attacks focus on gaining persistent access and financial theft, targeting e-commerce, payment infrastructures, and commercial platforms. The largest cluster, using Chinese language, targeted platforms in the US, Japan, and Australia, aiming to maintain long-term access via webshells. Another cluster focused on credit card and cryptocurrency theft, mainly from merchant payment services and gray-market sites, with some targets in Africa. A third cluster targeted e-commerce sites for shell, admin panel, and database access. The attackers succeeded in about 10% of attempts, exposing hundreds of secrets, some verified as valid. Notable victims include US companies such as John Deere and SharkNinja. No specific patch or remediation guidance is provided.
Southern Company has disclosed a data breach affecting approximately 400,000 customer accounts across its electric utilities Georgia Power, Alabama Power, and Mississippi Power. An unauthorized third party accessed limited customer account information via the company's online customer portal. The compromised data includes names, mailing addresses, phone numbers, emails, last four digits of Social Security numbers, and other basic account details. Sensitive financial information such as bank account numbers, payment card numbers, and driver’s license numbers were not accessed. The company has notified affected customers and is offering one year of free credit monitoring. The breach was detected and stopped promptly, with law enforcement engaged. Details about the intrusion timeline and attack vector have not been disclosed.
### Impact
When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies `x-ai-capabilities.response_semantics.oauth_card_path` into the manifest without validating that it is a safe package-relative file reference. An attacker can supply parent-directory traversal, rooted paths, or absolute URIs instead of a card file within the plugin package.
The unsafe reference is propagated into the generated manifest. Its security effect depends on the downstream host's handling of the reference when the plugin is packaged and deployed. This is not local code execution or a file read performed by Kiota merely during generation. A consuming host that resolves the untrusted reference can cross the intended package boundary or use an unintended authentication card.
### Affected versions
The affected NuGet packages are `Microsoft.OpenApi.Kiota` and `Microsoft.OpenApi.Kiota.Builder`, starting with version 1.25.1, which introduced this manifest field. The field remains unvalidated through version 1.34.1, including the separate 1.29.1 security-backport release. Version 1.35.0 fixes the issue.
### Patches
Upgrade to Kiota 1.35.0 or later and regenerate affected plugin manifests. Kiota now applies the existing safe-file-reference validator to `oauth_card_path`, drops unsafe references, and emits a warning. Valid relative card paths remain supported.
- Fix: https://github.com/microsoft/kiota/pull/8055
- Fixed release: https://github.com/microsoft/kiota/releases/tag/v1.35.0
### Workarounds
Generate plugins only from trusted, integrity-protected OpenAPI descriptions. Before packaging or deployment, review generated manifests and remove any `oauth_card_path` that is not a safe relative reference confined to the plugin package. Do not rely on validation of sibling manifest fields to validate this field.
### Related advisories
GHSA-4jwf-m4wg-8p66 and GHSA-p5rm-jg5c-8c77 cover `static_template.file`. Their fixes do not enforce validation at the separate `oauth_card_path` emission site.
A memory leak vulnerability exists in the Linux kernel's memstick driver due to improper destruction of the io_queue workqueue during card removal. This causes kernel memory exhaustion over repeated card insert/remove cycles.
A use-after-free vulnerability in the ALSA caiaq USB audio driver in the Linux kernel was addressed by decoupling the ep1_in_urb and midi_out_urb objects from the main device structure and managing their memory separately. This prevents the premature freeing of these URB objects when the sound card is released after a command timeout, which previously led to kernel memory corruption detected by KASAN.
The Linux Kernel, the operating system core itself.
Security Fix(es):
In the Linux kernel, the following vulnerability has been resolved:ALSA: caiaq: Use snd_card_free_when_closed() at disconnectionThe USB disconnect callback is supposed to be short and not too-longwaiting. OTOH, the current code uses snd_card_free() atdisconnection, but this waits for the close of all used fds, hence itcan take long. It eventually blocks the upper layer USB ioctls, whichmay trigger a soft lockup.An easy workaround is to replace snd_card_free() withsnd_card_free_when_closed(). This variant returns immediately whilethe release of resources is done asynchronously by the card devicerelease at the last close.This patch also splits the code to the disconnect and the free phases;the former is called immediately at the USB disconnect callback whilethe latter is called from the card destructor.(CVE-2024-56531)
In the Linux kernel, the following vulnerability has been resolved:xsk: fix OOB map writes when deleting elementsJordy says: In the xsk_map_delete_elem function an unsigned integer(map->max_entries) is compared with a user-controlled signed integer(k). Due to implicit type conversion, a large unsigned value formap->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL;This allows k to hold a negative value (between -2147483648 and -2),which is then used as an array index in m->xsk_map[k], which resultsin an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock);The xchg operation can then be used to cause an out-of-bounds write.Moreover, the invalid map_entry passed to xsk_map_sock_delete can leadto further memory corruption. It indeed results in following splat:[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108[76612.904330] #PF: supervisor write access in kernel mode[76612.909639] #PF: error_code(0x0002) - not-present page[76612.914855] PGD 0 P4D 0[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0[76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000[76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[76613.041086] PKRU: 55555554[76613.043842] Call Trace:[76613.046331] <TASK>[76613.048468] ? __die+0x20/0x60[76613.051581] ? page_fault_oops+0x15a/0x450[76613.055747] ? search_extable+0x22/0x30[76613.059649] ? search_bpf_extables+0x5f/0x80[76613.063988] ? exc_page_fault+0xa9/0x140[76613.067975] ? asm_exc_page_fault+0x22/0x30[76613.072229] ? xsk_map_delete_elem+0x2d/0x60[76613.076573] ? xsk_map_delete_elem+0x23/0x60[76613.080914] __sys_bpf+0x19b7/0x23c0[76613.084555] __x64_sys_bpf+0x1a/0x20[76613.088194] do_syscall_64+0x37/0xb0[76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53[76613.096962] RIP: 0033:0x7f80b6d1e88d[76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48[76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141[76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d[76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003[76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000[76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8[76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00---truncated---(CVE-2024-56614)
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential
RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.
A vulnerability in the Linux kernel's netfilter nf_tables component was resolved by changing the order of hardware offload steps to prevent inconsistent states between offloaded and software rulesets. This issue could cause discrepancies where the network interface card's offloaded ruleset and the software ruleset differ, potentially impacting system integrity. The vulnerability affects specific Linux kernel versions used in various Ubuntu distributions.
A vulnerability in the Linux kernel ALSA mtpav driver involves improper shutdown of an output timer before the sound card teardown. The issue arises because the timer callback can continue running and rearm the timer after the card state is released, leading to potential use-after-free conditions. The flaw has been fixed by calling timer_shutdown_sync() outside the spinlock to ensure any running callbacks complete before releasing resources.
A use-after-free vulnerability in the Linux kernel's usbtv media driver was resolved. The issue arises because ALSA PCM callbacks store driver state in pcm->private_data, and an open PCM file can outlive USB disconnect. This leads to a scenario where the usbtv device structure may be freed prematurely, causing a later close operation to dereference freed memory. The fix involves taking a V4L2 device reference for the ALSA card and dropping it only after ALSA has closed remaining files, ensuring the device structure remains valid.
Project RedTeam: Contract Offensive is a forthcoming educational game designed to teach network intrusion methodology through a gamified, card-based roguelite experience. The game simulates real-world cybersecurity tradecraft mapped to MITRE ATT&CK techniques, allowing players to engage in simulated corporate network intrusions. It is intended as a learning tool and does not contain real organizations or actionable illegal hacking instructions. The game is not a security threat or vulnerability but rather an educational simulation.
Telus, a major Canadian telecom provider, experienced a multi-month account breach campaign from February 2025 to June 2026. Attackers used stolen credentials to access subscriber personal data and billing records, including names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The compromised information was used to attempt to convince customers to switch services and, in some cases, to make unauthorized changes to accounts. Telus reset affected credentials and implemented enhanced security monitoring. The Vancouver Police Department was notified, and identity theft protection services were offered to victims. The breach appears linked to credential stuffing or account takeover using credentials possibly obtained from third parties, though this is not confirmed by Telus.
A high-severity vulnerability in the Linux kernel's via-sdmmc driver was resolved. The issue involves a race condition where card-detect work can run after the device interrupt is disabled and the host memory is freed, leading to use-after-free memory access. This could cause system instability or compromise. The vulnerability was identified through static analysis and manual review.
A use-after-free vulnerability in the Linux kernel's USB gadget audio driver (u_audio) was fixed. The flaw occurs during sound card disconnect when the driver prematurely frees memory still referenced by user-space ALSA control elements, leading to potential memory corruption. The fix defers freeing the sound card context until all references are released.
