CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel's IPv6 MLD module, there is a race condition between device teardown and MLD query processing, which can lead to use-after-free in the MLD delayed work.
In the Linux kernel, the netfilter nft_lookup module has a bug in catchall element handling with inverted lookups. The 'found' variable is not recomputed after 'ext' is replaced by the catchall lookup, which can lead to incorrect matching or skipping of the catchall element in negated queries.
In the Linux kernel, the IPVS module has an issue ensuring that inner headers in ICMP errors are in the skb headroom. After stripping outer headers with pskb_pull(), the inner IP headers may not be available for functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). Additional length checks for inner headers were added.
In the Linux kernel, the cifs module has a vulnerability due to lack of validation of string offsets in DFS responses. A malicious server can provide offsets pointing outside the response buffer, leading to out-of-bounds memory read during path name processing.
In the Linux kernel SUNRPC subsystem, a use-after-free vulnerability exists in the TLS connect path. Nothing pins the upper rpc_clnt across the delayed connect_worker, which can lead to dereferencing freed memory when a TLS connection fails (e.g., mTLS error).
In the Linux kernel TIPC subsystem, a vulnerability was found where the tracepoint in tipc_sk_enqueue() dumped the sk_receive_queue without proper locking, leading to a use-after-free condition reported by KASAN. The fix restricts the dump to the spinlock-protected backlog queue only.
In the Linux kernel, the ife_decode() function does not guarantee that the inner Ethernet header is accessible in the linear data area, which can lead to a crash with malformed IFE frames.
In the Linux kernel for KVM on s390, try_get_locked_pte() had an unlikely race that could occur if puds or pmds were unmapped between p?dp_get() and p?d_offset(). The fix eliminates this race.
In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had an issue during interrupt migration to another vCPU. After reacquiring locks, it only checked affinity, not whether the interrupt still belonged to this vCPU. The fix adds a check irq->vcpu == vcpu before moving.
In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had a race between interrupt affinity change and LPI disabling, which could lead to use-after-free (UAF). The fix takes a reference on the interrupt before dropping locks and does not attempt to migrate the pending bit.
In the Linux kernel, KVM arm64 (nested mode) mapping of L1 VNCR into host stage-1 did not respect read-only PFNs. The fix caches PFN writability and constrains mapping permissions, also fixing a page leak.
In the Linux kernel, KVM arm64 (nested mode) did not re-translate the VNCR address on a page fault. The fix invalidates the VNCR TLB entry and re-fetches the translation to allow write mapping on the second attempt.
In the Linux kernel, KVM arm64 (nested mode) unconditionally used cacheable memory attributes for L1 VNCR mappings, even if the underlying PFN is not memory. The fix rejects anything that isn't normal memory to avoid SError issues.
In the Linux kernel, the nf_nat_sip netfilter module has a vulnerability due to a stale data pointer after buffer reallocation. This can lead to packet header corruption.
In the Linux kernel, the netfilter flowtable module has a vulnerability due to using the route from the opposite direction when pushing the IPIP header. This can lead to incorrect headroom calculation and field settings.
In the Linux kernel, the netfilter flowtable module has a vulnerability that causes a crash during IPIP tunnel transmission with direct xmit. The lack of dst_entry leads to invalid dst usage and can trigger a crash.
In the Linux kernel x86/virt/sev subsystem, a previous fix regarding WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN was reverted. The call to wbinvd_on_all_cpus() before SNP_INIT_EX was restored to meet SNP specification requirements for clean cache lines.
In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_get_vid(), the skb buffer may be reallocated. The unicast_packet pointer was not reassigned after this reallocation, potentially leading to a use-after-free.
In the Linux kernel's batman-adv module, the number of VLANs in a TT unicast TVLV is of type u16 and is multiplied by the size of struct batadv_tvlv_tt_vlan_data (8 bytes). This can overflow the u16, invalidating all additional safety checks and potentially leading to an out-of-bounds read.
In the Linux kernel's SUNRPC subsystem, a use-after-free vulnerability exists in the asynchronous TLS handshake handling. The svc_xprt pointer is stored without taking a reference, leading to a race where the callback can write to freed memory. The issue affects NFS servers with TLS enabled when connection close overlaps with the tlshd downcall delivery window.