Search: gc.ca

CVE-2026-117994 is a use-after-free vulnerability in the JavaScript garbage collection component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The vulnerability is rated with high impact by Mozilla, indicating serious security concerns if exploited. No known exploits in the wild have been reported. Users are advised to update to the fixed versions to mitigate the risk.

A vulnerability in the Linux kernel's dm-pcache component allows a crafted kset to overrun its segment, causing a BUG_ON condition. This occurs because the cache_replay(), writeback worker, and GC worker functions read a kset size that can be manipulated to exceed the segment's remaining space, leading to an out-of-bounds advance. The issue is fixed by rejecting any kset whose on-media size exceeds the remaining segment size before use.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442) * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942) * kernel: gfs2: add some missing log locking (CVE-2026-53049) * kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z] (JIRA:RHEL-254192) * hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z] (JIRA:RHEL-262029) * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892) * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:RHEL-257457) * RHEL10.0 - kernel: CPU hotplug unsupported by CPUMF [rhel-10.2.z] (JIRA:RHEL-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

### Summary A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present. In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile. ### Affected package and versions - Package: `SixLabors.ImageSharp` (NuGet) - Affected range: `>= 1.0.0-beta0001, <= 4.1.1` - Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**. The parser defect is present from the first published NuGet prerelease, `1.0.0-beta0001`, through the latest published release, 4.1.1. The automatic `Image.Load` conversion path used by the main PoC exists in `>= 4.0.0, <= 4.1.1`; earlier versions expose the same parser defect through the public `IccProfile.Entries` accessor. ### Details The reproduced profile has an `A2B0` multi-process-elements (`mpet`) tag with a `clut` element declaring 15 input channels, 15 output channels, and three grid points per input channel. [`ReadClutF32`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/ICC/DataReader/IccDataReader.Lut.cs#L139-L162) computes `3^15 * 15` and allocates that many floats before reading any CLUT values or verifying that the tag has enough remaining data. The supplied 200-byte profile ends immediately after the CLUT grid descriptor. In v4, the path is reached when an application decodes an embedded ICC profile using `DecoderOptions.ColorProfileHandling = ColorProfileHandling.Convert`. The default setting, `Preserve`, does not parse the profile for conversion. In v1 through v3, `ReadClutF32` uses a jagged representation. Loading an ICC-bearing JPEG and then accessing `decoded.Metadata.IccProfile.Entries` reaches the public lazy parser. The malformed profile allocates the `3^15`-entry outer array before the missing CLUT values are detected. ### Reproduction environment and result The supplied automatic-conversion exploit and control were run against the published NuGet 4.1.1 `net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and .NET runtime 8.0.30. The same conversion fixture was run against published 4.0.0 and 4.1.0 with the same result. Published 1.0.0, 2.0.0, 2.1.13, 3.0.0, and 3.1.12 were tested through public JPEG decode followed by `IccProfile.Entries`; each allocated approximately 114.9 MB, skipped the malformed tag, and exited normally. The published `1.0.0-beta0001` public `IccProfile(bytes).Entries` path allocated 114,813,528 bytes before a catchable managed bounds exception. One exploit decode increased `GC.GetTotalAllocatedBytes(true)` by approximately 861.5 million bytes, then returned `InvalidIccProfileException: Invalid conversion method`. The reader catches the truncated-tag error and drops that tag. The identical input with `ColorProfileHandling.Preserve` completed successfully with roughly 0.5 million allocated bytes in the harness. One complete exploit run produced: ```text mode=exploit profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420 imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f observed_exception=SixLabors.ImageSharp.Metadata.Profiles.Icc.InvalidIccProfileException: Invalid conversion method. managed_bytes_allocated=861476416 Docker exit status: 0 ``` The control from the same image produced: ```text mode=control profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420 imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f decoded=1x1 icc_present=True managed_bytes_allocated=511888 Docker exit status: 0 ``` The exact allocation counter includes runtime allocations and varies slightly between processes; the requested CLUT array itself is 860,934,420 bytes. No active exploitation is known. ### Impact This report demonstrates a large attacker-controlled transient allocation in the ICC conversion path. It does not demonstrate unhandled process termination: allocation failure is caught while parsing the malformed tag, so the impact should be limited to memory pressure / input-validation failure unless a reproduction demonstrates a stronger result. ### Complete PoC files Program.cs: ```csharp using System; using System.Buffers.Binary; using System.IO; using System.Reflection; using SixLabors.ImageSharp; using SixLabors.ImageSharp.Formats; using SixLabors.ImageSharp.Formats.Png; using SixLabors.ImageSharp.Metadata.Profiles.Icc; using SixLabors.ImageSharp.PixelFormats; static class Program { private const int RequestedFloats = 215233605; // 3^15 * 15 private co

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) Bug Fix(es) and Enhancement(s): * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) Bug Fix(es) and Enhancement(s): * NFS client hangs while returning delegations (JIRA:RHEL-112278) * scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers (JIRA:RHEL-256998) * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) Bug Fix(es) and Enhancement(s): * crypto: xxhash64 should not be fips approved [rhel-10.0.z] (JIRA:RHEL-254942) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-98050 is a high-severity vulnerability in the Linux kernel's mlxsw spectrum_ptp driver. It involves unsafe concurrent mutation of the NAPI GRO list due to a call to napi_gro_receive() from a garbage-collection workqueue context, which can run concurrently with the NAPI poll thread on another CPU. This race condition can lead to kernel panic and system crashes. The issue is fixed by changing the packet delivery method to use netif_receive_skb(), which is safe to call outside the NAPI poll context.

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.

In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset key_num and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset key_num drives cache_kset_crc() and the replay loop in cache_replay(), the writeback worker and the GC worker, but only the magic and a fixed-seed CRC are checked first, so a non-last kset whose key_num exceeds the PCACHE_KSET_KEYS_MAX buffer reads past its end before the CRC compare. A key's intra-segment offset and length in cache_key_decode() are taken verbatim, so a key running past its segment is replayed into the cache tree and the data CRC check and every later read hit then copy adjacent persistent memory into the caller's bio -- an out-of-bounds read that leaks to user space. Both fields are controlled by whoever supplies the cache device (CAP_SYS_ADMIN); the CRC seed is public. Add kset_onmedia_valid() to bound key_num before any kset read, and reject a key whose offset plus length, computed in 64 bits, exceeds the segment data_size. Valid metadata is unaffected.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. Clamp the read to cache_seg_remain(), the data region.

A race condition vulnerability in the Linux kernel's NFS daemon (nfsd) file cache handling has been resolved. The flaw involves concurrent operations on the nfsd_file cache that can lead to resource leaks due to improper synchronization during shutdown and garbage collection. The fix involves widening locking mechanisms to ensure proper synchronization and prevent file and state leaks.

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double list_add_tail() call on bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers(). Analysis revealed that the root cause was the insertion of a page/folio with a page index of ULONG_MAX into the page cache via the GC ioctl. filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(), repeatedly detects a dirty folio with a page index of ULONG_MAX due to index wrap-around, leading to duplicate processing of dirty buffers. As a preparatory step, the GC ioctl loads the page/folio of the block to be moved during GC and inserts it into the page cache based on information in the nilfs_vdesc structure passed as an argument. Normally, this does not cause issues because the user-space GC library configures the nilfs_vdesc structure properly. However, since there is no range check on the parameters determining the page index, a request with artificially crafted parameters -- such as those generated by Syzbot -- can result in a page/folio being inserted with a page index of ULONG_MAX, triggering the above problem. This resolves the issue by checking the ranges of 'vd_offset' and 'vd_vblocknr' in the nilfs_vdesc structure that determine the page index, thereby preventing the invalid page/folio insertions.

CVE-2026-84118 is a use-after-free vulnerability in the JavaScript garbage collection component of Firefox. This security flaw was addressed and fixed in Firefox 155 and Firefox ESR 153.2. The vulnerability has a CVSS v3.1 base score of 5.4, indicating a medium severity level. It could potentially allow an attacker to cause limited confidentiality and integrity impacts, requiring user interaction but no privileges. No known exploits in the wild have been reported. The vendor advisory confirms the fix and recommends updating to the patched versions.

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.1.0 ESR. * Fixed: Various security fixes. MFSA 2026-77 (bsc#1274867): * CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component * CVE-2026-74935 Privilege escalation in the DOM: Networking component * CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component * CVE-2026-74937 Use-after-free in the JavaScript: GC component * CVE-2026-74938 Mitigation bypass in the JavaScript: GC component * CVE-2026-74939 Privilege escalation in the DOM: Navigation component * CVE-2026-74940 Use-after-free in the Graphics: Text component * CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component * CVE-2026-74942 Privilege escalation in the Remote Settings Client component * CVE-2026-74943 Use-after-free in the Graphics: ImageLib component * CVE-2026-74944 Use-after-free in the DOM: Core & HTML component * CVE-2026-74945 Information disclosure in the Graphics: Text component * CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component * CVE-2026-74948 Information disclosure in the Graphics component * CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component * CVE-2026-74950 Privilege escalation in the Downloads API component * CVE-2026-74953 Privilege escalation in the Networking: Cookies component * CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component * CVE-2026-74955 Privilege escalation in the Request Handling component * CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component * CVE-2026-74957 Mitigation bypass in the Safe Browsing component * CVE-2026-74958 Information disclosure in the WebRTC component * CVE-2026-74959 Mitigation bypass in the Storage: Cache API component * CVE-2026-74960 Site isolation issue in the WebExtensions component * CVE-2026-74961 Side-channel in the Web Audio component * CVE-2026-74962 Site isolation issue in the Networking: Cookies component * CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component * CVE-2026-74964 Integer overflow in the Graphics component * CVE-2026-74965 Privilege escalation in the Shell Integration component * CVE-2026-74966 Information disclosure in the Form Autofill component * CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component * CVE-2026-74968 Site isolation issue in the Graphics: WebRender component * CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component * CVE-2026-74970 Site isolation issue in the Graphics component * CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component * CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component * CVE-2026-74973 Race condition, use-after-free in the Graphics component * CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component * CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-74977 Integer overflow in the Graphics component * CVE-2026-74978 Clickjacking issue in the Widget component * CVE-2026-74979 Mitigation bypass in the Add-ons Manager component * CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component * CVE-2026-74982 Denial-of-service in the Widget component * CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component * CVE-2026-74984 Race condition in the JavaScript Engine component * CVE-2026-74985 Privilege escalation in the Enterprise Policies component * CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component * CVE-2026-74987 Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 * CVE-2026-74988 Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154 * CVE-2026-74990 Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 Firefox Extended Support Release 153.0esr ESR * New: ## General - Firefox now includes a new profile management system that helps you separate your online life into distinct profiles for work, school, vacation planning, or whatever you choose. Profiles can be customized with names, avatars, and color themes while keeping tabs, bookmarks, passwords, and browsing history separate. Built-in profile backup and restore also makes it easier to migrate to a new device or recover your browsing data. - Split View lets you view two webpages side-by-side in a single browser window, with additional options to quickly open links in Split View, rearrange

CVE-2026-80668 is a critical vulnerability in the Linux kernel's netfilter nf_conntrack_expect subsystem. It involves the replacement of the timer API with a garbage collection (GC) worker approach to manage expired connection tracking expectations. The update addresses a race condition that could cause use-after-free issues by ensuring proper synchronization and reference counting during expectation removal. This flaw affects multiple Linux kernel versions prior to their respective fixed releases.