CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, the DRM sun4i backend driver has an error pointer dereference bug. The function drm_atomic_get_plane_state() can return an error pointer that is not checked before use, potentially causing a system crash.
In the Linux kernel, the ASoC STI driver never frees regmap_field objects allocated during player init, potentially leaking resources when the driver is removed. The fix switches to devm_regmap_field_alloc() to automatically manage allocation lifetimes.
In passthrough mode of the dm-cache driver in the Linux kernel, a NULL pointer dereference occurs. When invalidating a cache entry and the bio prison cell lock fails due to a concurrent write to the same block, mg->cell remains NULL. The invalidate_complete() function attempts to unlock and free the cell without checking its validity, causing a system crash.
In the Linux kernel, the dm cache module has a bug in passthrough mode causing write hangs. The invalidate_remove() function mishandles write hit bios after cache invalidation, dropping the bio without submission.
In the Linux kernel, the SMQ cache policy for dm-cache devices lacks locks when invalidating cache blocks in passthrough mode. Concurrent invalidation operations from multiple workers can cause data races on the allocated blocks counter and use-after-free issues in internal data structures.
In the Linux kernel, the dm-cache module has a vulnerability in dirty mapping checking when switching to passthrough mode. The bug arises from an assumption that table reload occurs after suspension, which is broken by LVM's preload mechanism. This can lead to loading dirty mappings into passthrough mode, causing data loss.
A memory leak was discovered in the Linux kernel's dm_cache_metadata_abort function within the dm-cache module. When the root_lock cannot be acquired because the block manager is read-only, the temporary block manager created before the lock is not released, causing a memory leak.
In the Linux kernel, a vulnerability in the dm log module causes an out-of-bounds write due to a 32-bit integer overflow in region_count. The variable cannot hold the 64-bit result of sector division, leading to undersized buffer allocation and subsequent heap memory corruption.
In the Linux kernel graphics driver (cdns-mhdp8546-core), the connector pointer is not set early enough in atomic_enable(). During error recovery paths this can lead to a NULL pointer dereference and system crash.
A missing TLB and context cache invalidation after updating DDT/PDT entries was found in the Linux kernel's RISC-V IOMMU driver. The RISC-V IOMMU specification (Sections 6.3.1 and 6.3.2) mandates these invalidations to ensure address translation consistency.
In the Linux kernel, the drm/msm/dpu driver has a mismatch between voltage and frequency during runtime resume. Calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock remains at highest frequency, potentially causing instability or system crash.
In the Linux kernel's hisilicon/sec2 driver, a use-after-free vulnerability was found during packet transmission. Under heavy system load, hardware may complete packet processing and free the request memory (req) before the transmission function finishes, causing an error.
In the Linux kernel, a locking bug was found in the drm/msm driver's VM_BIND UNMAP operation. An incorrect argument caused objects involved in UNMAP operations not to be always locked. The issue affected non-_NO_SHARE buffer objects.
In the Linux kernel, a vulnerability was found in the AMD IOMMU subsystem's clone_alias() function. It incorrectly assumed the first argument (pdev) always points to the original device, while it could be an alias. This caused the wrong devid to be used when copying DTE entries, leading to incorrect or stale entries being propagated to the alias device.
In the ASoC audio driver for Qualcomm platforms (qdsp6), the widget type is not checked before accessing private data. A virtual widget may lack an associated DSP graph, leading to incorrect memory access.
In the Linux kernel, the PCI driver for Tegra194 has a CBB timeout caused by DBI register access before core power-on. When PERST# is deasserted twice, pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert(), causing a timeout.
A race condition in the Linux kernel's dquot_scan_active() function during quota deactivation was discovered. Under memory pressure, it can lead to use-after-free, causing system instability.
In the Linux kernel, the GFS2 filesystem lacked proper log locking in the gfs2_logd() function. Log flushing functions (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) were called without holding the sd_log_flush_lock, potentially causing race conditions with concurrent transactions. A new __gfs2_log_flush() function and proper locking were added to gfs2_logd().
In the GFS2 filesystem of the Linux kernel, a NULL pointer dereference can occur in gfs2_log_release() during unmount when sdp->sd_jdesc is NULL. The previous patch missed this case.
In the Linux kernel, the efi/capsule-loader module has an incorrect sizeof in phys array reallocation, leading to a potential heap buffer overflow on 32-bit PAE systems.