Linux Kernel eventpoll: Failure to Fix ep_remove struct eventpoll / struct file UAF

Status: EPSS-IMMINENT  |  Advisory ID: CVE-2026-46242

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: fix ep_remove struct eventpoll / struct file UAF

ep_remove() (via ep_remove_file()) cleared file->f_ep under

file->f_lock but then kept using @file inside the critical section

(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).

A concurrent __fput() taking the eventpoll_release() fastpath in

that window observed the transient NULL, skipped

eventpoll_release_file() and ran to f_op->release / file_free().

For the epoll-watches-epoll case, f_op->release is

ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which

kfree()s the watched struct eventpoll. Its embedded ->refs

hlist_head is exactly where epi->fllink.pprev points, so the

subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed

kmalloc-192 memory.

In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot

backing @file could be recycled by alloc_empty_file() --

reinitializing f_lock and f_ep -- while ep_remove() is still

nominally inside that lock. The upshot is an attacker-controllable

kmem_cache_free() against the wrong slab cache.

Pin @file via epi_fget() at the top of ep_remove() and gate the

critical section on the pin succeeding. With the pin held @file

cannot reach refcount zero, which holds __fput() off and

transitively keeps the watched struct eventpoll alive across the

hlist_del_rcu() and the f_lock use, closing both UAFs.

If the pin fails @file has already reached refcount zero and its

__fput() is in flight. Because we bailed before clearing f_ep,

that path takes the eventpoll_release() slow path into

eventpoll_release_file() and blocks on ep->mtx until the waiter

side's ep_clear_and_put() drops it. The bailed epi's share of

ep->refcount stays intact, so the trailing ep_refcount_dec_and_test()

in ep_clear_and_put() cannot free the eventpoll out from under

eventpoll_release_file(); the orphaned epi is then cleaned up

there.

A successful pin also proves we are not racing

eventpoll_release_file() on this epi, so drop the now-redundant

re-check of epi->dying under f_lock. The cheap lockless

READ_ONCE(epi->dying) fast-path bailout stays. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel SCTP Heartbeat ACK Chunk Caches a Transport Without Taking a Reference, Enabling Use-After-Free When That Transport Is Concurrently Removed

Status: UPDATED  |  Advisory ID: CVE-2026-74688

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed

sctp_make_heartbeat_ack() caches the destination transport in

chunk->transport without taking a reference. When src_out_of_asoc_ok is

enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead

of being transmitted immediately.

If the peer transport is removed while the chunk is still queued,

sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,

but only clears cached transport pointers in out_chunk_list. The queued

control chunk therefore retains a dangling transport pointer.

Once an ASCONF_ACK clears the suppression and the queued control chunk is

transmitted, SCTP dereferences the stale transport pointer, leading to a

use-after-free.

Fix this by also clearing chunk->transport for queued control chunks in

control_chunk_list when removing the transport. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel fbdev bit_cursor Does Not Clamp Glyph Index to Font charcount, Enabling Out-of-Bounds Read via Stale Screen Buffer Entries or vcs_write

Status: UPDATED  |  Advisory ID: CVE-2026-74635

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_cursor()

bit_cursor() fetches the glyph under the cursor with

c = scr_readw(vc_pos);

src = vc_font.data + ((c & charmask) * w * height);

where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer

value comes directly from scr_readw() and may be larger than the current

font's glyph count.

Syzkaller triggers this via vcs_write(). The Call Trace shows

vcs_write() in vc_screen.c writing an arbitrary 16-bit value with

writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via

vcs_scr_writew() without checking charcount. The stored value is later

read in bit_cursor() in bitblit.c.

When the font is changed from a font with 512 glyphs to a font with

256 glyphs, the screen buffer can retain characters with the high

bit set from the previous mode, which could also produce the same

out-of-bounds access.

BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70

Read of size 16 at addr ffff800086c57970

Call Trace:

soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70

bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365

fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427

hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883

update_region+0x100/0x18c drivers/tty/vt/vt.c:669

vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685

bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph

index to vc_font.charcount. Apply the same clamp in bit_cursor() after

extracting the attribute and masking, before indexing fontdata.

The fix completes the bounds checking started in commit 18c4ef4e765a

("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed

the cursor path.

This change should be safe because the clamp reuses the existing

contract from fbcon: charcount is maintained under console_lock in

con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when

switching from 512 to 256 glyphs. When stale screen data with high bits

remains after a font switch, or when vcs_write() stores an arbitrary

value, clamping the index to 0 prevents the out-of-bounds read without

changing cursor semantics — the same fallback bit_putcs uses. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel SCTP Retransmit Path Moves a Gap-Acked Chunk to a New Transport Without Updating the Chunk's Cached Transport Pointer, Enabling Use-After-Free

Status: UPDATED  |  Advisory ID: CVE-2026-74588

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sctp: keep chunk->transport in step with the list it is queued on

__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's

transmitted list without updating chunk->transport:

if (chunk->tsn_gap_acked) {

list_move_tail(&chunk->transmitted_list,

&transport->transmitted);

continue;

}

The chunk then sits on a live transport's list while chunk->transport still

names a different one. If that transport is removed - sctp_assoc_rm_peer()

from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk

is left with a dangling pointer. sctp_assoc_rm_peer() scrubs

peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on

neither.

The pointer is not followed while tsn_gap_acked is set. A SACK that

reneges on the TSN clears the flag, and the next SACK reaches

tchunk->transport->flight_size -= sctp_data_size(tchunk);

inside the freed transport. KASAN reports a slab-use-after-free read in

sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the

removal and the SACKs come from the association peer.

Set chunk->transport at the move. The ordinary resend path needs nothing:

it reaches its list_move_tail() only after sctp_packet_append_chunk()

returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the

chunk by then.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel SCTP Teardown Path Frees the Cached Outbound ASCONF Chunk Without Clearing the Cache Pointer, Exposing a Use-After-Free

Status: UPDATED  |  Advisory ID: CVE-2026-74587

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix use-after-free of cached ASCONF chunk

addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal

ASCONF-ACK completion path releases the chunk and clears the pointer.

However, sctp_asconf_queue_teardown() releases the cached chunk without

clearing addip_last_asconf. During peer restart handling,

sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes

sctp_asconf_queue_teardown() while the association remains alive and leaves

the pointer dangling.

A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),

which accesses the stale chunk and passes it to sctp_process_asconf_ack(),

causing a use-after-free and a second release.

Clearing the pointer exposes a race with T4 expiry. Peer restart handling

queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses

timer_delete(), which does not wait for a callback already running on

another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after

the purge and dereference NULL.

Clear addip_last_asconf after releasing the cached chunk, and make

sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding

ASCONF remains. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel SCTP Fails to Clear new_transport After DEL-IP Peer Removal, Leaving a Dangling Pointer That Subsequent ASCONF Processing Reads

Status: UPDATED  |  Advisory ID: CVE-2026-74586

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear new_transport when removing a peer

sctp_process_asconf_param() stores a newly added peer transport in

asoc->new_transport. After all parameters in the ASCONF chunk have been

processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the

new transport.

An authenticated ASCONF from a remote SCTP peer can add a transport and

remove it again with a wildcard DEL-IP parameter in the same chunk. The

wildcard deletion preserves the transport on which the ASCONF arrived, but

removes the newly added transport through

sctp_assoc_del_nonprimary_peers(). The removal does not clear

asoc->new_transport, leaving it pointing to the removed transport.

sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points

to the removed transport without holding a transport reference. During

local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on

control_chunk_list. After the transport is freed by RCU, a successful

ASCONF_ACK for the replacement address releases the queued HEARTBEAT and

sctp_outq_select_transport() reads the freed transport's state.

The issue was found during a static audit of SCTP objects. With an

authenticated peer, the reproducer triggered the same KASAN report in 2

of 2 unpatched runs on a KASAN-enabled netdev/main kernel:

BUG: KASAN: slab-use-after-free in sctp_outq_select_transport

Read of size 4 at addr ffff88800b9bd95c by task python3/197

Call Trace:

sctp_outq_select_transport+0x549/0x8b0 [sctp]

sctp_outq_flush+0x306/0x2c60 [sctp]

sctp_transport_immediate_rtx+0xaf/0x260 [sctp]

sctp_process_asconf_ack+0xa48/0xf70 [sctp]

Allocated by task 197:

sctp_transport_new+0x68/0x650 [sctp]

sctp_assoc_add_peer+0x258/0x12a0 [sctp]

sctp_process_asconf+0x5e9/0x1090 [sctp]

Last potentially related work creation:

__call_rcu_common.constprop.0+0x77/0xb70

sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]

sctp_process_asconf+0xd9c/0x1090 [sctp]

The first invalid access was a four-byte read of transport->state at

net/sctp/outqueue.c:833. The same reproducer completed the full

authenticated ASCONF and local-address replacement sequence with this

change without a KASAN report or oops.

Clear new_transport when its peer is removed, before it can be used to

create the HEARTBEAT. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Enterprise Linux GLib Out-of-Bounds Read Reachable by Unauthenticated Remote Attackers (CVSS 7.5)

Status: UPDATED  |  Advisory ID: CVE-2026-58016

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. (NVD)

What to Do

Monitor Red Hat's and GNOME's web pages for any future patch releases.

References

Enterprise Linux GLib Denial of Service Reachable by Unauthenticated Remote Attackers (CVSS 7.3)

Status: UPDATED  |  Advisory ID: CVE-2026-58014

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. (NVD)

What to Do

Monitor Red Hat's and GNOME's web pages for any future patch releases. See vendor advisory link below.

References

Red Hat's Windows Machine Config Operator skips SSH host-key checks, letting adjacent attackers capture node bootstrap credentials

Status: UPDATED  |  Advisory ID: CVE-2026-54100

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

What to Do

Monitor Red Hat's web page for any future patch releases. See vendor advisory link below.

References

A compromised Windows node can forge a cluster-administrator certificate through WMCO's CSR auto-approver, CVSS 8.8

Status: UPDATED  |  Advisory ID: CVE-2026-54099

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and signed by the cluster, yielding a client certificate that grants cluster-administrator privileges and enabling full cluster takeover.

What to Do

Monitor Red Hat's web page for any future patch releases. See vendor advisory link below.

References

Red Hat OpenShift AI 3.4 libgnutls Heap Overread Reachable by Unauthenticated Remote Attackers (CVSS 8.2)

Status: UPDATED  |  Advisory ID: CVE-2026-5260

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Enterprise Linux libsolv Buffer Overflow Reachable by Unauthenticated Local Attackers (CVSS 7.8)

Status: UPDATED  |  Advisory ID: CVE-2026-48864

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Red Hat OpenShift AI 3.4 gnutls Security Flaw Reachable by Unauthenticated Remote Attackers (CVSS 8.2)

Status: UPDATED  |  Advisory ID: CVE-2026-42013

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Red Hat OpenShift AI 3.4 gnutls Information Disclosure Reachable by Unauthenticated Remote Attackers (CVSS 7.1)

Status: UPDATED  |  Advisory ID: CVE-2026-42012

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Red Hat OpenShift AI 3.4 gnutls Authorization Bypass Reachable by Unauthenticated Remote Attackers (CVSS 7.4)

Status: UPDATED  |  Advisory ID: CVE-2026-42011

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Enterprise Linux gnutls Authorization Bypass Reachable by Low-Privilege Remote Attackers (CVSS 7.1)

Status: UPDATED  |  Advisory ID: CVE-2026-42010

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process. (NVD)

What to Do

Monitor Red Hat's and gnu's web pages for any future patch releases. See vendor advisory link below.

References

Enterprise Linux gnutls Denial of Service Reachable by Unauthenticated Remote Attackers (CVSS 7.5)

Status: UPDATED  |  Advisory ID: CVE-2026-42009

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service. (NVD)

What to Do

Monitor Red Hat's and gnu's web pages for any future patch releases.

References

Red Hat OpenShift AI 3.4 Buffer Overflow Reachable by Unauthenticated Remote Attackers (CVSS 7.5)

Status: UPDATED  |  Advisory ID: CVE-2026-33846

Key Details

Affected Products, Subsystems & Sectors

What to Know

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

Enterprise Linux Out-of-Bounds Read Reachable by Unauthenticated Remote Attackers (CVSS 7.5)

Status: UPDATED  |  Advisory ID: CVE-2026-33845

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service. (NVD)

What to Do

Monitor Red Hat's and gnu's web pages for any future patch releases. See vendor advisory link below.

References

Red Hat OpenShift AI 3.3 xdgmime Buffer Overflow Reachable by Unauthenticated Local Attackers (CVSS 7.1)

Status: UPDATED  |  Advisory ID: CVE-2026-16118

Key Details

Affected Products, Subsystems & Sectors

What to Know

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption. (NVD)

What to Do

Monitor Red Hat's and xdg's web pages for any future patch releases.

References

Red Hat OpenShift AI 3.4 Double-Free Reachable by Unauthenticated Remote Attackers (CVSS 7.5)

Status: UPDATED  |  Advisory ID: CVE-2026-14164

Key Details

Affected Products, Subsystems & Sectors

What to Know

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

CISA's October 16th KEV Deadline Adds Federal Urgency to Microsoft Windows Shell Command Injection That Lets Network Attackers Bypass a Security Feature

Status: KEV  |  Advisory ID: CVE-2026-96951

Key Details

Affected Products, Subsystems & Sectors

What to Know

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

What to Do

Monitor Microsoft's web page for any future patch releases.

References

KEV Required Action

Siemens RUGGEDCOM CROSSBOW Bulk Export Workflow Does Not Sanitize Device Group and Facility Names Before Using Them in Database Queries, Enabling SQL Injection

Status: UPDATED  |  Advisory ID: CVE-2026-89201

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens RUGGEDCOM CROSSBOW Allows Low-Privileged Authenticated Users to Retrieve Administrative Credentials for Internal Systems via Insufficiently Restricted Database Queries

Status: UPDATED  |  Advisory ID: CVE-2026-89199

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens RUGGEDCOM CROSSBOW Does Not Sanitize Firmware Upload Filenames Before Using Them in Database Queries, Enabling SQL Injection for Low-Privileged Authenticated Users

Status: UPDATED  |  Advisory ID: CVE-2026-89198

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens RUGGEDCOM CROSSBOW Does Not Sanitize the Notification Condition Value Field, Enabling SQL Injection for Low-Privileged Authenticated Users

Status: UPDATED  |  Advisory ID: CVE-2026-89197

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens RUGGEDCOM CROSSBOW Does Not Sanitize Facility Names in Bulk Import and Export Workflows, Enabling SQL Injection for Low-Privileged Authenticated Users

Status: UPDATED  |  Advisory ID: CVE-2026-89196

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens SIMATIC S7 Webserver API .NET Client Library Writes Files to Attacker-Chosen Paths When a Ticket Download Response Supplies a Crafted Filename

Status: UPDATED  |  Advisory ID: CVE-2026-85114

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.

This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens Industrial Edge App Publisher Renders Unsanitized Backend Data in a Node.js UI, Allowing Cross-Site Scripting That Achieves Remote Code Execution

Status: UPDATED  |  Advisory ID: CVE-2026-78557

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens Industrial Edge App Publisher Does Not Validate Server Certificates During TLS Connections, Enabling Man-in-the-Middle Interception

Status: UPDATED  |  Advisory ID: CVE-2026-78556

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Siemens SIMATIC IPC Products Include a BIOS Vendor Test Key in the UEFI Secure Boot Database, Allowing Locally Privileged Attackers to Boot Unsigned Software

Status: UPDATED  |  Advisory ID: CVE-2026-72895

Key Details

Affected Products, Subsystems & Sectors

What to Know

A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Huawei openUBMC Ships Identical Hard-Coded SNMPv3 Authentication and Encryption Keys That Are Not Reset by Admin Password Changes and Grant Full Device Control

Status: UPDATED  |  Advisory ID: CVE-2026-65198

Key Details

Affected Products, Subsystems & Sectors

What to Know

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades. (NVD)

What to Do

Monitor huawei's web page for any future patch releases.

References

Linux Kernel cgroup rstat BPF kfunc Accepts a Caller-Controlled CPU Index Without Bounds Checking, Enabling Array Out-of-Bounds

Status: UPDATED  |  Advisory ID: CVE-2026-64036

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts a

caller-provided cpu argument. The function uses cpu for per-cpu rstat

lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an

invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==

0x7fffffff triggers:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9

index 2147483647 is out of range for type 'long unsigned int [64]'

Call Trace:

css_rstat_updated

bpf_iter_run_prog

cgroup_iter_seq_show

bpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc and

move the common implementation to __css_rstat_updated() for in-kernel

callers. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel igc Driver Does Not Initialize the TX Buffer Type for SMD Frames, Letting a Stale XDP or XSK Entry Direct TX Completion to the Wrong Cleanup Path

Status: UPDATED  |  Advisory ID: CVE-2026-64035

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

igc: set tx buffer type for SMD frames

Sashiko pointed out that igc_fpe_init_smd_frame() initializes

igc_tx_buffer fields for an SMD skb, but does not set the buffer type:

https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp

Since igc_tx_buffer entries are reused, a stale XDP or XSK type can

remain and make TX completion use the wrong cleanup path.

Set the buffer type to IGC_TX_BUFFER_TYPE_SKB. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel MANA Driver TOCTOU Double-Fetch of hwc_msg_id from Unencrypted DMA Memory Bypasses Bounds Validation in Confidential VMs

Status: UPDATED  |  Advisory ID: CVE-2026-64034

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from

DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp()

re-reads the same field from the same DMA buffer for test_bit() and

pointer arithmetic.

DMA-coherent memory is mapped uncacheable on x86 and is shared,

unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes

directly to host-visible memory. A H/W can modify the value

between the check and the use, bypassing the bounds validation.

Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a

stack-local variable in mana_hwc_rx_event_handler(), and passing the

validated value as a parameter to mana_hwc_handle_resp(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel RDMA/rtrs Server Path Error Cleanup Frees srv_path via kobject_put Before the sysfs Teardown Finishes Reading It

Status: UPDATED  |  Advisory ID: CVE-2026-64033

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrs_srv_create_path_files(), the sysfs root folders

may already have been created and srv_path->kobj may already have been

initialized. If a later step fails, the cleanup currently calls

kobject_put(&srv_path->kobj) before

rtrs_srv_destroy_once_sysfs_root_folders(srv_path).

kobject_put() may drop the last reference to srv_path->kobj and invoke the

release callback, rtrs_srv_release(), which frees srv_path. The following

call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then

dereferences srv_path internally to access srv_path->srv, resulting in a

use-after-free.

This failure path is reached before rtrs_srv_create_path_files() returns

success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling

kobject_put(&srv_path->kobj), so srv_path is still valid while the helper

accesses it.

This issue was found by a static analysis tool I am developing. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel Bridge Per-Port Multicast Context Remains Active After Port Removal When Both Global and Per-VLAN Snooping Have Been Enabled, Triggering Use-After-Free

Status: UPDATED  |  Advisory ID: CVE-2026-64032

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over

all the bridge ports, disables the per-port multicast context on each

port and enables the per-{port, VLAN} multicast contexts instead. The

reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all

the bridge ports and enables the per-port multicast context on each

port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts

(per-port and per-{port, VLAN}) are enabled on a single bridge port:

# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

# ip link add name dummy1 up master br1 type dummy

# ip link set dev br1 type bridge mcast_vlan_snooping 1

# ip link set dev br1 type bridge mcast_snooping 0

# ip link set dev br1 type bridge mcast_snooping 1

This is not intended and it is a problem since the commit cited below.

Prior to this commit, when removing a bridge port,

br_multicast_disable_port() would disable the per-port multicast context

and the per-{port, VLAN} multicast contexts would get disabled when

flushing VLANs.

After this commit, br_multicast_disable_port() only disables the

per-port multicast context if per-VLAN multicast snooping is disabled.

If both types of contexts were enabled on the port when it was removed,

the per-port multicast context would remain enabled when freeing the

bridge port, leading to a use-after-free [1].

Fix by preventing the bridge from enabling / disabling the per-port

multicast contexts when toggling global multicast snooping if per-VLAN

multicast snooping is enabled.

[1]

ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)

WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0

[...]

Call Trace:

<IRQ>

__debug_check_no_obj_freed (lib/debugobjects.c:1116)

kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)

kobject_cleanup (lib/kobject.c:689)

rcu_do_batch (kernel/rcu/tree.c:2617)

rcu_core (kernel/rcu/tree.c:2869)

handle_softirqs (kernel/softirq.c:622)

__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)

irq_exit_rcu (kernel/softirq.c:752)

sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))

</IRQ> (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel erofs Unaligned Compressed Extent Race Allows Two Pclusters to Concurrently Add the Same folio to the Managed Cache

Status: UPDATED  |  Advisory ID: CVE-2026-64031

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix managed cache race for unaligned extents

After unaligned compressed extents were introduced, the following race

could occur:

[Thread 1] [Thread 2]

(z_erofs_fill_bio_vec)

<handle a Z_EROFS_PREALLOCATED_FOLIO folio>

...

filemap_add_folio (1)

(z_erofs_bind_cache)

<the same folio is found..>

..

..

folio_attach_private (2)

filemap_add_folio (3) again

Since (1) is executed but (2) hasn't been executed yet, it's possible

that another thread finds the same managed folio in z_erofs_bind_cache()

for a different pcluster and calls filemap_add_folio() again since

folio->private is still Z_EROFS_PREALLOCATED_FOLIO.

Fix this by explicitly clearing folio->private before making the folio

visible in the managed cache so that another pcluster can simply wait

on the locked managed folio as what we did for other shared cases [1].

This only impacts unaligned data compression (`-E48bit` with zstd,

for example).

[1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of

crafted images properly") was originally introduced to handle crafted

overlapped extents, but it addresses unaligned extents as well. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel mac80211 EPCS Handler Does Not Bound link_id to the Valid Range, Letting a Connected WiFi 7 AP Trigger a Kernel Crash via a Crafted Action Frame

Status: UPDATED  |  Advisory ID: CVE-2026-64030

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted

from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.

sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),

making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response

action frame with a PER_STA_PROFILE subelement where link_id = 15. The

unsolicited-notification path (dialog_token = 0) is reachable any time

EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activate_links_work

(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),

so the NULL check on the result does not catch the invalid access. The

garbage pointer is then passed to ieee80211_sta_wmm_params(), which

dereferences link->sdata and crashes the kernel.

The same class of bug was fixed for ieee80211_ml_reconfiguration() by

commit 162d331d833d ("wifi: mac80211: bounds-check link_id in

ieee80211_ml_reconfiguration"). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel ALSA UMP Sequence Client Borrows the Output File Without Synchronizing Against Its Close, Enabling Use-After-Free in snd_rawmidi_kernel_write1

Status: UPDATED  |  Advisory ID: CVE-2026-64029

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Serialize UMP output teardown with event_input

seq_ump_process_event() borrows client->out_rfile.output without

synchronizing with the first-open and last-close transition in

seq_ump_client_open() and seq_ump_client_close().

The last output unuse can therefore drop opened[STR_OUT] to zero and

release the rawmidi file while an in-flight event_input callback is still

inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream

runtime exposed to teardown before the write path has taken its own

buffer reference.

Add a per-client rwlock for the event_input-visible output file. Publish

a newly opened output file under the write side, and hold the read side

from the output lookup through snd_rawmidi_kernel_write(). The last

output close copies and clears the visible output file under the write

side, then drops the lock and releases the saved rawmidi file. Use

IRQ-safe rwlock guards because event_input can also be reached from

atomic sequencer delivery.

The buggy scenario involves two paths, with each column showing the

order within that path:

path A label: event_input path path B label: last unuse path

1. seq_ump_process_event() reads 1. seq_ump_client_close()

client->out_rfile.output. drops opened[STR_OUT] to zero.

2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()

has not yet pinned runtime. closes the output file.

3. The writer continues using 3. close_substream() frees

the borrowed substream. substream->runtime.

This keeps the output substream and runtime alive for the full

event_input write while keeping rawmidi release outside the rwlock.

KASAN reproduced this as a slab-use-after-free in

snd_rawmidi_kernel_write1(), with allocation through

seq_ump_use()/snd_seq_port_connect() and free through

seq_ump_unuse()/snd_seq_port_disconnect().

Validation reproduced this kernel report:

KASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400

RIP: 0033:0x7f5528af837f

Read of size 8

Call trace:

dump_stack_lvl+0x73/0xb0 (?:?)

print_report+0xd1/0x650 (?:?)

srso_alias_return_thunk+0x5/0xfbef5 (?:?)

__virt_addr_valid+0x1a7/0x340 (?:?)

kasan_complete_mode_report_info+0x64/0x200 (?:?)

kasan_report+0xf7/0x130 (?:?)

snd_rawmidi_kernel_write1+0x9d/0x400 (?:?)

__asan_load8+0x82/0xb0 (?:?)

update_stack_state+0x1ef/0x2d0 (?:?)

snd_rawmidi_kernel_write+0x1a/0x20 (?:?)

seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82)

__snd_seq_deliver_single_event+0x8a/0xe0 (?:?)

snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?)

lock_acquire+0x14e/0x2e0 (?:?)

find_held_lock+0x31/0x90 (?:?)

snd_seq_port_use_ptr+0xa6/0xe0 (?:?)

__kasan_check_write+0x18/0x20 (?:?)

do_raw_read_unlock+0x32/0xa0 (?:?)

_raw_read_unlock+0x26/0x50 (?:?)

snd_seq_deliver_single_event+0x45c/0x4b0 (?:?)

snd_seq_deliver_event+0x10d/0x1b0 (?:?)

snd_seq_client_enqueue_event+0x192/0x240 (?:?)

snd_seq_write+0x2cd/0x450 (?:?)

apparmor_file_permission+0x20/0x30 (?:?)

security_file_permission+0x51/0x60 (?:?)

vfs_write+0x1ce/0x850 (?:?)

__fget_files+0x12b/0x220 (?:?)

lock_release+0xc8/0x2a0 (?:?)

__rcu_read_unlock+0x74/0x2d0 (?:?)

__fget_files+0x135/0x220 (?:?)

ksys_write+0x15a/0x180 (?:?)

rcu_is_watching+0x24/0x60 (?:?)

__x64_sys_write+0x46/0x60 (?:?)

x64_sys_call+0x7d/0x20d0 (?:?)

do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)

entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel Network Shaper XArray Entry Swap Invalidates a Concurrently Read VALID Mark, Causing Use-After-Free in Rollback

Status: UPDATED  |  Advisory ID: CVE-2026-64027

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: rework the VALID marking (again)

Recent commit changed the semantics from NOT_VALID to VALID.

I didn't realize that the flags are not stored atomically

with the entry in XArray. There's still a race of reader

observing a VALID mark for a slot, getting interrupted,

writer replacing the entry with a different one, reader

continuing, fetching the entry which is now a different

pointer than the pointer for which VALID was meant.

The biggest consequence of this is that we may see a UAF

since net_shaper_rollback() assumed that entries without

VALID can be freed without observing RCU.

Looks like the XArray marks are buying us nothing at this

point. Let's convert the code to an explicit valid field.

The smp_load_acquire() / smp_store_release() barriers are

marginally cleaner. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Linux Kernel rxrpc Decrypts DATA Packets In Place When splice() Shares the Pages, Corrupting the Pagecache

Status: UPDATED  |  Advisory ID: CVE-2026-64026

Key Details