CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module related to the Qualcomm Crypto Engine (QCE). The ksmbd_crypt_message() function does not properly handle the -EINPROGRESS return code from async hardware, leading to premature DMA request freeing and freed memory dereference in the callback.
In the Linux kernel, the memory driver for Tegra124 (tegra124-emc) had a reversed check for DLL enable in the EMRS register. DLL is enabled when bit A0 is low, but the code checked the opposite.
In the Linux kernel, a vulnerability in the soc/tegra: cbb driver uses incorrect ARRAY_SIZE in fabric lookup tables, potentially causing out-of-bounds access during target timeout lookup.
In the Linux kernel's OCFS2 filesystem and its DLM (Distributed Lock Manager) component, a vulnerability was found due to missing validation of the `qr_numregions` field in the `dlm_match_regions()` function. An attacker can send a crafted DLM_QUERY_REGION network message with an inflated `qr_numregions` value, causing an out-of-bounds read beyond the `qr_regions` buffer.
In the Linux kernel, a vulnerability was found due to incorrect class initialization ordering in the fwctl driver. When the CXL module is loaded before fwctl, the fwctl class registration is not yet complete, causing the knode_class initialization to be skipped. On device removal, a NULL pointer dereference occurs.
In the Linux kernel, a bug was found in the OCFS2 filesystem's listxattr() function. When an inode has both inline and block-based extended attributes and the inline names exactly fill the caller's buffer, the function may return a size larger than the buffer, causing a kernel panic (BUG).
In the Linux kernel, a vulnerability in the OCFS2 filesystem lacks validation of the bg_bits field during freefrag scan in the non-coherent path (OCFS2_INFO_FL_NON_COHERENT). A crafted filesystem can cause an out-of-bounds memory read (use-after-free) when processing the OCFS2_IOC_INFO ioctl.
In the Linux kernel, the OCFS2 filesystem has a vulnerability due to missing input validation before caching in the OCFS2_IOC_GROUP_ADD operation. An attacker can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(), causing a system crash.
A vulnerability in the Linux kernel causes an out-of-bounds read in the hash_algo_name array during IMA initialization. The issue occurs when the TPM 2.0 module supports a hash algorithm (e.g., SHA3-256) not yet defined in the kernel, leading to memory access errors and potential system crash.
A deadlock vulnerability was found in the Linux kernel's hid_post_reset() function in the HID USB driver. The issue occurs when a USB device includes both a HID component and a storage/UAS component that are reset together. Memory allocations in hid_pre_reset() and hid_post_reset() may perform blocking I/O, leading to a deadlock on the mutex held during device reset.
In the Linux kernel, an off-by-one error was found in the check_imm function used by the ARM64 BPF JIT to validate immediate values for conditional and unconditional branches. The flaw allows values one bit wider than the signed N-bit field can hold, potentially causing incorrect instruction encoding and reversing branch direction.
A deadlock vulnerability was discovered in the Linux kernel's BPF sockmap mechanism during AF_UNIX socket iteration. The issue occurs when bpf_iter_unix_seq_show() takes the fast path of lock_sock_fast() and the iter program attempts to update a sockmap, causing recursive locking of the same slock-AF_UNIX lock.
A vulnerability was found in the Linux kernel's sockmap mechanism for AF_UNIX sockets. During connect(), the socket state is set to TCP_ESTABLISHED before the peer socket is assigned, allowing a race condition with sockmap updates that leads to a NULL pointer dereference.
A race condition in the Linux kernel's BPF sockmap for af_unix sockets causes a use-after-free when a BPF iterator updates a sockmap. The fix adds a state lock to ensure socket stability during the update.
In the Linux kernel, a vulnerability in the BPF subsystem causes a NULL pointer dereference in map_kptr_match_type() when a scalar register is stored into a kptr slot. The code accesses reg->btf without first checking if the register has a BTF type, leading to a crash.
A vulnerability was found in the Linux kernel in the arena_alloc_pages() function within the BPF subsystem. The function accepts a node_id as a plain int and forwards it through the allocation chain without any bounds checking.
In the Linux kernel, a memory leak was found in the i3c driver for Renesas platforms. The xfer structure allocated by renesas_i3c_alloc_xfer() was never freed in the renesas_i3c_i3c_xfers() function.
In the Linux kernel's NTFS3 filesystem (ntfs3), a vulnerability was found involving the use of an uninitialized 'lcn' variable in the ntfs_iomap_begin() function. The issue occurs when the block length (len) is zero, causing 'lcn' to be used before initialization.
In the Linux kernel USB Type-C driver, an error pointer dereference was found. The function does not properly check the partner registration result, which can lead to ERR_PTR dereference and potential system crash.
In the NTFS3 file system in the Linux kernel, a bug was found where the run load for VCN0 is missing in the attr_data_get_block_locked() function. This can lead to incorrect reads and trigger a WARN_ON(1) warning.