CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Linux kernel's 6LoWPAN multicast address compression function contains an off-by-one error. This overwrites the RIID field and leaks uninitialized kernel stack memory over the network.
A Use-After-Free (UAF) vulnerability was found in the Linux kernel's L2TP PPPoL2TP driver. The pppol2tp_ioctl() function accessed the session pointer without proper locking or reference counting, allowing a race condition during copy_from_user(). The fix securely fetches the session reference using an RCU-safe, refcounted helper.
In the Linux kernel, a vulnerability in the devlink mechanism causes a nested relation to not be released when a devlink instance fails before registration. This results in a memory leak of the devlink->rel structure.
A vulnerability was found in the Linux kernel's TCP stack in reqsk_queue_hash_req(). Preemption between mod_timer() and refcount_set() can cause premature timer expiration and a refcount underflow, leading to use-after-free.
A use-after-free vulnerability was found in the Linux kernel's IPv6 anycast implementation, where an anycast address (aca) could be inserted into the global hash after the device teardown had already removed it from the interface list, leading to a dangling pointer. The fix moves the hash insertion under the idev->lock to ensure atomicity with device removal.
A memory leak in the Linux kernel's Wi-Fi subsystem has been identified during 6 GHz scanning. The rdev->int_scan_req object is not freed when cfg80211_scan() fails because rdev->scan_req remains NULL, preventing proper memory release in ___cfg80211_scan_done().
In the Linux kernel, a vulnerability in the cfg80211 subsystem could cause a crash in mac80211 when eht_cap is set but eht_oper is missing. Consistency enforcement for HE/EHT elements has been added to prevent this.
A use-after-free vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem in the rfcomm_connect_ind() function. The issue stems from missing reference counting on the listening socket after leaving the rfcomm_sk_list lock, allowing a race condition with socket closure and potential exploitation.
In the Linux kernel Bluetooth stack, an out-of-bounds read vulnerability was found in tlv_data_is_valid(). A malformed MGMT_OP_ADD_ADVERTISING request can cause reading one byte past the allocated buffer, as reported by KASAN.
In the Linux kernel, a vulnerability in Bluetooth RFCOMM MCC handlers fails to validate skb length before accessing data. A remote attacker can send truncated MCC frames, triggering out-of-bounds reads.
A vulnerability was found in the Linux kernel's Bluetooth BNEP subsystem due to missing frame length validation before parsing. A remote attacker can send a short BNEP SDU frame, causing a slab-out-of-bounds read and potentially system instability.
A memory leak in the error path of hci_alloc_dev() in the Linux kernel was fixed. When Bluetooth HCI UART device initialization fails before registration, the HCI_UNREGISTER flag is not set, bypassing hci_release_dev() and leaking SRCU percpu memory. The fix explicitly calls cleanup_srcu_struct() in the unregistered branch of bt_host_release().
In the Linux kernel Bluetooth ISO subsystem, a reference leak of the hci_dev structure was found. The iso_conn_big_sync function fails to release the reference obtained by hci_get_route(), leading to memory exhaustion.
A TOCTOU vulnerability was found in the Linux kernel's xsk_skb_metadata() function related to TX metadata processing in the XSK mechanism. A malicious userspace application can race to overwrite csum_start and csum_offset values between two reads, bypassing bounds validation and causing out-of-bounds memory access during checksum computation.
In the Linux kernel, the ability to set IP LSRR and SSRR options has been restricted to users with CAP_NET_RAW capability. This prevents unprivileged applications from forcing packet routing through attacker-controlled nodes to leak TCP ISN and other protocol information.
In the Linux kernel's airoha network driver, a use-after-free vulnerability was found in metadata dst teardown. The metadata_dst_free() function freed memory directly via kfree(), bypassing the RCU grace period, allowing access to freed memory through noref pointers in the RX path.
In the Linux kernel's mtk_eth_soc network driver, a use-after-free vulnerability was found. The mtk_free_dev() function calls metadata_dst_free() which immediately frees the metadata_dst memory, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer, which can lead to accessing freed memory if any skb still holds that pointer during driver teardown.
In the Linux kernel SCTP stack, the length of a cached INIT chunk in COOKIE_ECHO processing was not validated. Missing validation can lead to out-of-bounds reads and potential memory corruption.
In the Linux kernel MRP subsystem, a vulnerability was found in the mrp_pdu_parse_vecattr() function. Parsing errors in vector attributes can lead to incorrect packet processing, including spurious events, skipped FirstValue fields, and incorrect attribute value incrementation.
In the Linux kernel, a vulnerability in nfsd4_create_file() can cause a failure to release a lock on the parent directory due to improper error handling from dentry_create(). This occurs when an exported filesystem uses atomic_create() and returns an error.