---METADATA---
VENDOR: Linux
PRODUCT: Kernel (rtl8723bs)
AFFECTED_VERSIONS: 4.12 up to (excluding) 5.10.261, 5.15.212, 6.1.178, and 6.6.145
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Linux kernel rtl8723bs Wi-Fi driver contains a WEP length underflow and out-of-bounds read vulnerability in the OnAuth() function.

Executive Summary:
A critical buffer overflow vulnerability in the Linux rtl8723bs Wi-Fi driver allows an attacker within radio range to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-64445

Affected Software: Linux Kernel (rtl8723bs driver)

Affected Versions: 4.12 up to (excluding) 5.10.261, 5.15.212, 6.1.178, and 6.6.145

Vulnerability: This is a memory corruption vulnerability involving an integer underflow and out-of-bounds read within the OnAuth() function of the rtl8723bs driver. An unauthenticated attacker within radio range can send malformed 802.11 authentication frames to trigger this flaw.

Business Impact

The CVSS score of 8.8 reflects the high risk posed by this vulnerability, particularly for mobile or embedded devices using the rtl8723bs chipset. An attacker could achieve remote code execution, leading to a complete compromise of the wireless device or significant denial-of-service, potentially impacting corporate network integrity.

Remediation Plan

Immediate Action: Update the Linux kernel to versions 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later.

Proactive Monitoring: Monitor wireless interface logs for abnormal authentication patterns or frequent driver-related crashes.

Compensating Controls: If the kernel cannot be updated, disable the rtl8723bs driver or restrict the use of the affected wireless hardware in high-security environments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving radio-frequency access, makes it an attractive target for proximity-based attacks.

Analyst Recommendation

Organizations should prioritize patching systems running the rtl8723bs driver. Given that this vulnerability can be triggered by unauthenticated attackers within radio range, it represents a significant security risk that requires urgent attention.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (ksmbd)
AFFECTED_VERSIONS: 7.1-rc7 and 6.1.176 up to (excluding) 6.1.178, 6.6.145, 6.12.96, and 6.18.39
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel ksmbd module occurs when handling deferred file locks during an SMB2_CLOSE followed by an SMB2_CANCEL.

Executive Summary:
A critical use-after-free flaw in the Linux ksmbd module allows an authenticated SMB client to trigger memory corruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-64437

Affected Software: Linux Kernel (ksmbd)

Affected Versions: 7.1-rc7 and 6.1.176 up to (excluding) 6.1.178, 6.6.145, 6.12.96, and 6.18.39

Vulnerability: The vulnerability is a use-after-free flaw in the ksmbd server implementation. An authenticated attacker can trigger the vulnerability by sending a specific sequence of SMB2_CLOSE and SMB2_CANCEL commands, leading to the reuse of a freed file_lock object.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to organizations utilizing ksmbd for file sharing. Successful exploitation could allow an attacker to gain unauthorized access to data, modify files, or execute arbitrary code with kernel-level privileges, leading to a total compromise of the affected server.

Remediation Plan

Immediate Action: Update the Linux kernel to the patched versions 6.1.178, 6.6.145, 6.12.96, or 6.18.39 immediately.

Proactive Monitoring: Review SMB server traffic logs for unusual command sequences or repeated connection drops that might indicate an exploitation attempt.

Compensating Controls: If patching is delayed, disable the ksmbd service or restrict SMB access to trusted network segments to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While external sources have suggested potential exploitation exists in private circles, it remains unconfirmed by public research data.

Analyst Recommendation

Due to the severity of this vulnerability and its potential for remote code execution, immediate patching is required. Organizations should treat this as a high-priority update to protect their file storage infrastructure.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 2.6.21 up to (excluding) 5.10.261, 5.15.212, 6.1.178, and 6.6.145
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Linux kernel af_key module fails to initialize the alg_key_len field for IPComp states, causing an out-of-bounds read during state cloning.

Executive Summary:
A high-severity memory safety vulnerability in the Linux kernel af_key module could allow a local attacker to cause a system crash or potentially leak sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-64436

Affected Software: Linux Kernel

Affected Versions: 2.6.21 up to (excluding) 5.10.261, 5.15.212, 6.1.178, and 6.6.145

Vulnerability: This is an out-of-bounds read vulnerability resulting from uninitialized memory in the af_key module. An attacker with local access can trigger this flaw when an IPComp state is cloned during an XFRM_MSG_MIGRATE operation.

Business Impact

The vulnerability carries a CVSS score of 7.1, indicating a high risk to system stability and data confidentiality. Successful exploitation could lead to local denial-of-service conditions or the exposure of kernel memory contents, which may facilitate further privilege escalation attacks.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches by updating the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later.

Proactive Monitoring: Monitor system logs for kernel panic events or repeated XFRM related errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to local system resources and limit the ability of low-privileged users to execute complex networking operations where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an implementation error in memory management that requires an authenticated local user to trigger.

Analyst Recommendation

Given the potential for system disruption, administrators should prioritize updating kernel packages to the identified fixed versions. Patching is the most effective way to remediate this memory safety issue and prevent potential local exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Accordion and Accordion Slider
AFFECTED_VERSIONS: 1.4.6
---END_METADATA---

Description Summary:
The Accordion and Accordion Slider plugin for WordPress version 1.4.6 contains a malicious backdoor injected by threat actors.

Executive Summary:
A critical supply chain compromise in the Accordion and Accordion Slider plugin introduces a persistent backdoor into all affected WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-6443

Affected Software: WordPress Accordion and Accordion Slider

Affected Versions: 1.4.6

Vulnerability: The plugin was acquired by malicious actors who subsequently injected a backdoor into the source code. This allows for persistent unauthorized access and the injection of spam content into the host site.

Business Impact

With a CVSS score of 9.8, this represents a total compromise of the affected website's integrity. The backdoor allows for ongoing unauthorized access, potential data theft, and significant reputational damage due to injected spam.

Remediation Plan

Immediate Action: Immediately remove the plugin from all WordPress installations. Do not rely on updates from the current maintainer.

Proactive Monitoring: Scan the site file system for unauthorized scripts and monitor database logs for suspicious content injections.

Compensating Controls: Implement a file integrity monitoring (FIM) solution to detect unauthorized changes to core or plugin files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this is a deliberate backdoor, the plugin should be considered permanently untrusted. Organizations must remove the plugin immediately and perform a forensic audit of the site to identify any previously injected malicious code.