CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel perf/amd/ibs driver, perf_allow_kernel() is called from NMI context, which is unsafe and can cause a crash. Permissions should be cached at initialization.
In the Linux kernel ath11k driver, memory leaks occur in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid(). Allocated beacon template memory is not freed on error.
In the rtlwifi driver in the Linux kernel, there is a use-after-free (UAF) vulnerability due to an unfinished irq_prepare_bcn_tasklet. When the card is detached or initialization fails, ieee80211_hw is freed, but the tasklet may still be running, leading to access to freed memory.
A null pointer dereference vulnerability was found in the Linux kernel's bpf_lwt_xmit_push_encap function. The issue occurs when skb->_skb_refdst is not initialized during BPF program test runs, leading to a kernel crash.
In the Linux kernel, the s390 BPF JIT subsystem lacks zero extension for BPF program return values and kfunc arguments. According to the s390x ABI, callers must zero-extend unsigned arguments and callees must zero-extend unsigned return values, which is currently not implemented.
A bug in the Linux kernel's pte_frag_destroy function for PowerPC causes a 'Bad page state' error when freeing PTE table fragments. The issue occurs when pt_frag_refcount reaches zero but the 'active' flag on the folio is not cleared before pagetable_free(), leading to a kernel panic during process exit.
A race condition in the Linux kernel during unmap operations on PMD migration entries has been fixed. The issue occurs when move_pages and munmap syscalls are executed concurrently, triggering a VM_BUG_ON in pmdp_huge_get_and_clear_full. The vulnerability affects PowerPC 64-bit architecture.
In the Linux kernel libertas driver, usb_kill_urb() is called from interrupt context, which can cause synchronization issues. Instead, the driver now checks for pending URBs.
A fix in the Linux kernel for potential deadlock in BPF local storage. Deleting selem in NMI context could deadlock, so an error check was added.
In the mt76 WiFi driver (mt7925 model), there is a bug in mt7925_mac_write_txwi where missing NULL check for 'vif' pointer can lead to NULL pointer dereference and kernel panic.
In the mt76 WiFi driver, there is a memory leak when destroying the device. Rx queues have an associated page_pool that is not destroyed in mt76_dma_cleanup, and pages are not returned to the pool when WED is not enabled.
In the Linux kernel, the mt7925 driver (mt76) has a potential deadlock in mt7925_roc_abort_sync. It calls cancel_work_sync() while roc_work() holds dev->mt76.mutex, causing a lockup. This occurs during station removal.
In the Linux kernel, in the mt76 driver, mt76_connac_mcu_alloc_sta_req() allocates an skb that should be freed by mt76_mcu_skb_send_msg(). However, if an intermediate function (mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv()) fails before sending, the allocated skb leaks.
In the Linux kernel, a potential deadlock was found in the mt76 mt7921 WiFi driver in the mt7921_roc_abort_sync function. This function can deadlock on cancel_work_sync() when roc_work() holds dev->mt76.mutex and the caller already owns the same mutex. The deadlock occurs during station removal in the path mt76_sta_remove -> mt7921_mac_sta_remove -> mt7921_roc_abort_sync.
In the Linux kernel, the mt76 driver has a deadlock in mt76_remain_on_channel() and mt76_roc_complete(). They call mt76_set_channel() while already holding dev->mutex, causing a lockup.
In the Linux kernel, the configuration option was switched from CONFIG_CFI_CLANG to CONFIG_CFI, as it is now compiler-agnostic. Using the old name results in the code being compiled out, meaning CFI failures for btf_dtor_kfunc_t would still trigger.
In the mt76 (mt7915) WiFi driver in the Linux kernel, a use-after-free bug was found in mt7915_mac_dump_work(). During PCI device detachment, crash_data is freed before pending work is canceled, leading to dereference of freed memory.
In the Linux kernel's mt76 (mt7996) WiFi driver, a use-after-free bug occurs during PCI chip detachment. The mt7996_mac_dump_work() function may dereference already freed crash_data because dump_work is not canceled before memory deallocation.
In the Linux kernel, dev_map_redirect_multi() for DEVMAP_HASH used unsafe hlist_for_each_entry_safe() instead of RCU-safe hlist_for_each_entry_rcu(). On weakly-ordered architectures (ARM64, POWER), this can lead to observing a partially-constructed node.
A vulnerability in the Linux kernel regarding abuse of kprobe_write_ctx via freplace programs. Uprobe programs can modify struct pt_regs, and through kprobe+freplace they can affect kernel function arguments. The fix disallows attaching freplace programs to kprobe with different kprobe_write_ctx values.