Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
rtmutex: Use waiter::task instead of current in remove_waiter()
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
task
Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
changelog ]
Statistics
- 3 Posts
Last activity: 13 hours ago
Bluesky
ASUS I005 Linux Kernel CVE-2026-43499 Local Privilege Escalation https://packetstorm.news/files/231284 #exploit
Honor WIN RT AAK-AN00 CVE-2026-43499 Local Privilege Escalation https://packetstorm.news/files/231291 #exploit
Overview
- checkpoint
- Quantum Security Gateway
09 Sep 2026
Published
10 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.36%
KEV
Description
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
Statistics
- 2 Posts
Last activity: 9 hours ago
Bluesky
Check Point VPNにCVSS 9.8の脆弱性 2件 オランダNCSCが早期悪用を警告（CVE-2026-85102／CVE-2026-85103）
rocket-boys.co.jp/security-mea...
#セキュリティ対策Lab #security #securitynews #セキュリティ
Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: stop killed, freed and out_of_sync sharing a byte
The three connection state flags are single-bit bitfields, so they occupy
one byte of struct smc_connection and every store to one is a
read-modify-write of the other two:
u8 killed : 1;
u8 freed : 1;
u8 out_of_sync : 1;
They are not written under a common lock. smc_cdc_msg_validate() sets
out_of_sync from the receive tasklet, while smc_conn_kill() sets killed
from process context under lock_sock(), and the receive path does not defer
to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only
bh_lock_sock().
Give each flag its own byte so a store no longer touches its neighbours.
All readers test them as booleans and are unchanged. struct smc_connection
grows by two bytes.
Statistics
- 1 Post
Last activity: 21 hours ago
Fediverse
CVE-2026-80980 Linux kernel net/smc bitfield race - killed, freed, out_of_sync share one byte without a common lock, a data race that can corrupt connection state. CVSS N/A, patch status unknown/unpatched. Audit https://www.valtersit.com/cve/CVE-2026-80980/ #CVE #Linux #infosec
Overview
- proxy-addr
- proxy-addr
15 Sep 2026
Published
15 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
Pending
KEV
Description
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.
Statistics
- 2 Posts
Last activity: 3 hours ago
Fediverse
🚨 Critical-severity security fix in proxy-addr@2.0.8 just released!
Patches CVE-2026-90711: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,
whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.
The HW therefore matches only a 20-bit Stream ID.
The bound check rejects only virt_sid > UINT_MAX, which admits a value far
wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit
above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match
on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id
is guest-controlled, a VMM can trigger it.
Validate virt_sid against the field width with FIELD_MAX(), and program the
register with FIELD_PREP() so the value and the field stay consistent.
Statistics
- 1 Post
Last activity: 1 hour ago
Fediverse
CVE-2026-89450 Linux kernel iommu/tegra241-cmdqv: vSID wider than SID_MATCH field bypasses bound check, dropping bits above 20. CVSS N/A, unpatched. Update immediately. https://www.valtersit.com/cve/CVE-2026-89450/ #CVE #Linux #infosec
Overview
- Shinobi Systems
- Shinobi
29 Aug 2026
Published
31 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
0.41%
KEV
Description
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.
Statistics
- 1 Post
Last activity: 19 hours ago
Fediverse
A critical Shinobi vulnerability (CVE-2026-82448) uses a hardcoded child node key to reach the camera database unauthenticated. Patch and lock port 8288.
#Shinobi #CVE202682448 #CCTV #Vulnerability #HardcodedKey #CyberSecurity #InfoSec
Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: max17040: synchronize work cancellation on suspend
max17040_work() requeues itself after every poll. cancel_delayed_work()
only cancels a pending instance and does not wait for a callback that is
already running.
If system suspend races with the polling callback, the callback can
continue accessing the fuel gauge and requeue itself after the suspend
callback returns.
Use cancel_delayed_work_sync() to ensure polling is quiesced before
suspend completes.
Statistics
- 1 Post
Last activity: 12 hours ago
Fediverse
CVE-2026-89461 Linux kernel max17040 power supply race on suspend. Work callback can keep running and requeue itself after suspend, causing use-after-suspend. No CVSS, still unpatched. Update kernel when fix lands. #CVE #Linux https://www.valtersit.com/cve/CVE-2026-89461/
Overview
- D-Link
- DI-8300
15 Sep 2026
Published
15 Sep 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
Pending
KEV
Description
A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Statistics
- 1 Post
Last activity: 2 hours ago
Fediverse
D-Link DI-8300 (fw 16.07) hit by CRITICAL stack buffer overflow (CVE-2026-91003) in /rzgl.asp — remote RCE possible, public exploit code out. Restrict access & monitor traffic until patch. https://radar.offseq.com/threat/cve-2026-91003-stack-based-buffer-overflow-in-d-link-di-8300-ce23f2734338a347 #OffSeq #CVE202691003 #DLink #Security
Overview
- checkpoint
- Quantum Security Gateway
09 Sep 2026
Published
10 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.33%
KEV
Description
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Statistics
- 2 Posts
Last activity: 9 hours ago
Bluesky
Check Point VPNにCVSS 9.8の脆弱性 2件 オランダNCSCが早期悪用を警告（CVE-2026-85102／CVE-2026-85103）
rocket-boys.co.jp/security-mea...
#セキュリティ対策Lab #security #securitynews #セキュリティ
Overview
Description
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Avoid locking internal accesses during unmap
iommufd_access_notify_unmap() skips internal accesses because they do
not have an external unmap callback to invoke.
However, the current test calls iommufd_lock_obj() before checking
whether the access is internal. If iommufd_lock_obj() succeeds, the loop
then sees the internal access and continues, bypassing the matching
iommufd_put_object() used by the normal unmap path. This leaks the
object reference taken by iommufd_lock_obj().
Check for internal accesses first so skipped entries are never locked.
Statistics
- 1 Post
Last activity: 18 hours ago
Fediverse
CVE-2026-89447 Linux kernel iommufd flaw: internal accesses skip the matching put during unmap, risking a refcount/lock imbalance. No CVSS yet, patch status unknown. Patch or update now. https://www.valtersit.com/cve/CVE-2026-89447/ #CVE #Linux #infosec