Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-80758Medium· 4.7kernel: futex: Avoid private hash use-after-free on final put (CVE-2026-80758)
A flaw was found in the Linux kernel's futex subsystem. A race condition in the `futex_private_hash_put()` function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is droppe…
CVE-2026-80760Low· 2.3kernel: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (CVE-2026-80760)
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The `mgmt_hci_cmd_sync()` function incorrectly handles the `params_len` field, allowing a value greater than 255 to be processed. This mismatch between the decla…
CVE-2026-80792High· 7.0ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LW…
CVE-2026-80790Medium· 4.1kernel: nvmet-fc: fix invalid free in LS IOD error path (CVE-2026-80790)
A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could …
CVE-2026-80806Medium· 4.7kernel: ext4: don't enable DAX on new encrypted files (CVE-2026-80806)
A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorre…
CVE-2026-80813Medium· 5.7kernel: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (CVE-2026-80813)
A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmet_execute_identify_nslist() function by issuing a specific Identify command (CNS 07h). This vulnerability can lead …
CVE-2026-80824High· 7.0kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is premat…
CVE-2026-80816Medium· 4.6kernel: ALSA: FCP: Use a private URB for the notification endpoint (CVE-2026-80816)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) driver. Incorrect handling of the Universal Serial Bus Request Block (URB) for the notification endpoint could lead to a system…
CVE-2026-80819Medium· 6.5kernel: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (CVE-2026-80819)
A flaw was found in the Bluetooth RFCOMM (Radio Frequency Communication) subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect (DISC) message to a device with a deferred RFCOMM channel. This can…
CVE-2026-80818Medium· 4.4kernel: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown (CVE-2026-80818)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. This vulnerability, a use-after-free, occurs when the system attempts to deinitialize a virtual interface during device teardown, accessing memory that has already been re…
CVE-2026-80829Medium· 4.6kernel: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (CVE-2026-80829)
A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed `wMaxPacketSize` value, the device can trigger an out-of-bounds w…
CVE-2026-80830Medium· 5.1kernel: usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)
A flaw was found in the Linux kernel's USB subsystem. A race condition in the `usb_wakeup_notification()` function could allow a local attacker or a malicious USB device to trigger a use-after-free vulnerability. This could lead to system …
CVE-2026-80832Medium· 4.4kernel: crypto: qce - fix CCM AAD buffer underallocation (CVE-2026-80832)
A flaw was found in the Linux kernel's QCE (Qualcomm Crypto Engine) cryptographic module. An issue with buffer underallocation in the `qce_aead_ccm_prepare_buf_assoclen()` function can lead to the allocated AAD (Additional Authenticated Da…
CVE-2026-80846Medium· 5.1kernel: xfrm: drop ESP-in-TCP packets with no ingress device (CVE-2026-80846)
A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This ca…
CVE-2026-80854Medium· 4.7kernel: usb: gadget: f_tcm: keep port count until LUN teardown completes (CVE-2026-80854)
A flaw was found in the Linux kernel's f_tcm USB gadget module. A race condition can occur during the teardown of a Logical Unit Number (LUN) when it overlaps with a session removal. This timing issue can lead to a use-after-free vulnerabi…
CVE-2026-80862Medium· 5.1kernel: nvme-tcp: fix usage of page_frag_cache (CVE-2026-80862)
A flaw was found in the Linux kernel's nvme-tcp component. When block devices are created in parallel threads, the `page_frag_cache` is used in a manner that is not thread-safe. This can lead to incorrect reference counting of memory pages…
CVE-2026-80837High· 7.0In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 (ac5b0e5651b1)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 (ac5b0e5651b1). The trace was captured on 7.2.0-…
CVE-2026-80836Medium· 5.7In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bound…
In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bound…
CVE-2026-85666High· 7.5OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along …
CVE-2026-85676Medium· 4.3Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redir…
CVE-2026-80878High· 7.0kernel: afs: Fix leak of ungot volume (CVE-2026-80878)
A flaw was found in the Linux kernel's AFS (Andrew File System) implementation. This issue occurs when `afs_lookup_volume_rcu()` fails to acquire a volume, leading to a resource leak. A local attacker could potentially exploit this flaw to…
CVE-2026-85507Critical· 9.8⚖ disputedipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
CVE-2026-85730High· 8.2PoCsmol-toml is a small, fast, and correct TOML parser and serializer
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUn…
CVE-2026-80841High· 7.0In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ri…
CVE-2026-80860Medium· 4.7In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&re…
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&re…
CVE-2026-85625High· 8.1PoCsift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function …
CVE-2026-85664High· 7.5Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server…
CVE-2026-85506Critical· 9.8⚖ disputedipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
CVE-2026-57166Medium· 5.3⚖ disputedPJSIP is a free and open source multimedia communication library written in C
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several co…
CVE-2026-57163Critical· 9.1PJSIP is a free and open source multimedia communication library written in C
PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (t…