CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability was found in the reset driver for Amlogic T7 SoCs. Missing reset operations cause a null pointer dereference in the kernel, potentially leading to system crashes. Currently, reset is not used on this SoC.
A use-after-free vulnerability was found in the Linux kernel's enetc network driver, related to DMA buffer handling in the NTMP mechanism. The bug can lead to silent memory corruption when a freed DMA buffer is reused by hardware.
In the Linux kernel, a vulnerability was found in the airoha network driver. Early initialization of the ndesc variable in airoha_qdma_init_tx_queue() causes a NULL pointer dereference in airoha_qdma_cleanup_tx_queue() when queue entry list allocation fails.
In the Linux kernel network driver for Airoha chips, a NULL pointer dereference vulnerability was found. It occurs when queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue(), and then airoha_qdma_cleanup() tries to delete RX queue NAPI even though netif_napi_add() was never called. The issue is caused by early initialization of the ndesc variable, which is used to check if the queue is properly initialized.
In the Linux kernel, the MANA network driver is vulnerable to a double invocation of mana_remove(). If PM resume fails, mana_probe() calls mana_remove(), which nullifies context pointers. On subsequent driver unbind, a second mana_remove() call dereferences a NULL pointer, causing a kernel panic.
In the Linux kernel, the mailbox-test driver fails to free channels on probe error, causing a memory leak and potential use-after-free (UAF) scenarios because the client structure is removed automatically by devm.
A sanity check for the channel array was added in the Linux kernel mailbox driver. Without it, a missing channel array could cause a NULL pointer dereference and kernel OOPS, especially during early initialization.
In the Linux kernel, the mailbox-test driver has a double-free vulnerability when the RX channel is aliased to the TX channel with different MMIO. Freeing both channels triggers the bug.
In the Linux kernel, multiple bugs were found in the amdgpu driver's AMDGPU_INFO_READ_MMR_REG function. Issues include incorrect lock ordering (reset semaphore and mm_lock), memory allocation while holding the reset semaphore, and using down_read_trylock() instead of waiting for reset completion.
A vulnerability in the Linux kernel's Phonet subsystem causes a kernel BUG in pn_socket_autobind() when socket binding fails. The issue occurs when pn_socket_bind() returns -EINVAL due to invalid socket state with a zero port, leading to a kernel panic from a user-triggerable path.
In the Conexant audio driver for the Linux kernel, the return value of the jack detection registration function is not checked. If memory allocation fails, the driver continues with an unregistered callback, potentially causing a kernel crash.
In the Linux kernel, a use-after-free vulnerability was found in the DRM driver for Intel Xe GPUs. The xe_eu_stall_stream_close() function called drm_dev_put() before disabling the stream and freeing resources, potentially accessing freed memory.
In the Linux kernel's ice driver, a NULL pointer dereference vulnerability was found in ice_reset_all_vfs(). When VSI rebuild fails (e.g., during NVM firmware update), txq_map and rxq_map remain NULL, and subsequent ice_vf_post_vsi_rebuild() call causes a kernel panic.
In the Linux kernel for ARM64 architecture, a vulnerability was found due to insufficient reserved pages for early kernel mapping. This can cause a buffer overflow and potentially compromise system stability.
A copy-paste error in the Linux kernel's audit_log_capset() function causes CAPSET audit records to report the effective capability set in the inheritable field instead of the actual inheritable set. This bug has been present since 2008.
In the Linux kernel's idpf driver, a vulnerability causes double free and use-after-free in auxiliary device error paths. When auxiliary_device_add() fails, the error handling code incorrectly falls through, freeing the same iadev structure twice and accessing freed memory.
In the Linux kernel, a bug in the AMD Display driver (DCN32) causes a kernel crash when allocating memory for phantom planes. The issue occurs because dcn32_enable_phantom_plane() calls kvzalloc() within a softirq-disabled region, triggering BUG_ON(in_interrupt()).
In the Linux kernel's Btrfs filesystem, a bug was found where the dirty_pages io tree was prematurely cleared after a failed write during transaction commit. This caused dirty extent buffers to not be properly cleaned up during unmount, leading to warnings and potential data loss.
In the Linux kernel AMD IOMMU driver, a missing bounds check for the device ID (devid) in __rlookup_amd_iommu() caused an out-of-bounds read and a general protection fault (GPF) at boot when a PCI device was not described in the IVRS table.
A vulnerability was found in the Linux kernel's kexec mechanism. After recent changes, in a non-kjump kexec path the return address is no longer pushed onto the stack, causing purgatory code to attempt reading a non-existent address, leading to a fault and potential system hang.