---METADATA---
VENDOR: Rapid7
PRODUCT: InsightConnect Sed Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the Rapid7 InsightConnect Sed Plugin, allowing authenticated attackers to execute arbitrary system commands via the expression parameter.

Executive Summary:
An authenticated OS command injection vulnerability in the Rapid7 InsightConnect Sed Plugin allows attackers to execute arbitrary code on the underlying Linux host.

Vulnerability Details

CVE-ID: CVE-2026-9155

Affected Software: Rapid7 InsightConnect Sed Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This command injection vulnerability arises from insufficient input validation of the expression parameter within the plugin. An authenticated attacker can leverage this weakness to inject and execute arbitrary OS commands with the privileges of the application process.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the server hosting the InsightConnect plugin. This grants the attacker a foothold to pivot into the internal network, exfiltrate sensitive configuration data, or disrupt business operations. The CVSS score of 8.8 reflects the high severity of full system compromise via remote command execution.

Remediation Plan

Immediate Action: Apply the vendor-provided security update for the InsightConnect Sed Plugin immediately to remediate the input validation failure.

Proactive Monitoring: Review logs for unusual process execution patterns or unexpected system calls originating from the InsightConnect service.

Compensating Controls: Enforce the principle of least privilege by running the plugin service under a restricted user account to limit the impact of a potential command injection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Command injection flaws are highly dangerous and often lead to full system compromise. Organizations utilizing Rapid7 InsightConnect must prioritize the application of this patch and review access controls to ensure that only authorized and trusted users can interact with the affected plugin parameters.

---METADATA---
VENDOR: LinuxCNC
PRODUCT: LinuxCNC
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the rtapi_app component of LinuxCNC linuxcnc-uspace allows for potential privilege escalation or unauthorized control of the machine controller.

Executive Summary:
A high-severity vulnerability in LinuxCNC's rtapi_app component poses a risk of unauthorized command execution and potential loss of control over critical industrial machinery.

Vulnerability Details

CVE-ID: CVE-2026-58302

Affected Software: LinuxCNC LinuxCNC

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the rtapi_app process in linuxcnc-uspace. This component, which manages real-time application interactions, is susceptible to an unspecified flaw that may allow an attacker to achieve unauthorized execution or privilege escalation.

Business Impact

LinuxCNC is frequently used in industrial and manufacturing environments; therefore, a compromise of this software could result in operational disruption, equipment damage, or safety hazards. With a CVSS score of 8.4, the potential for unauthorized control over industrial hardware necessitates immediate attention to ensure the safety and continuity of production processes.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the LinuxCNC project as soon as they become available.

Proactive Monitoring: Monitor system logs for unexpected execution of rtapi_app or unauthorized attempts to access real-time kernel interfaces.

Compensating Controls: Implement strict network segmentation to isolate the machine controller from general-purpose networks, ensuring only authorized personnel have access to the system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the software, the potential for exploitation in industrial environments is high.

Analyst Recommendation

This vulnerability represents a significant risk to the availability and integrity of automated manufacturing systems. Administrators must treat this as a high-priority issue and apply vendor-supplied updates immediately upon release to prevent potential unauthorized control of industrial hardware.

---METADATA---
VENDOR: LiteSpeed Technologies
PRODUCT: cPanel plugin
AFFECTED_VERSIONS: LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)
---END_METADATA---

Description Summary:
A symlink mishandling vulnerability in the LiteSpeed cPanel plugin allows users with limited access to escalate privileges on shared hosting environments.

Executive Summary:
A critical symlink mishandling vulnerability in the LiteSpeed cPanel plugin has been confirmed as exploited in the wild, posing a significant risk to shared hosting security.

Vulnerability Details

CVE-ID: CVE-2026-54420

Affected Software: LiteSpeed Technologies cPanel plugin

Affected Versions: LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)

Vulnerability: The vulnerability involves the improper handling of symlinks by the plugin. An attacker with existing FTP or web shell access on a shared hosting server running CloudLinux/CageFS can exploit this to bypass security constraints.

Business Impact

With a CVSS score of 8.5 (High), this vulnerability represents a severe risk for multi-tenant hosting environments. Exploitation leads to unauthorized file access and potential privilege escalation across isolated user environments, which can result in complete compromise of customer data and service integrity.

Remediation Plan

Immediate Action: Update the LiteSpeed cPanel plugin to version 2.4.8 or later and the LiteSpeed WHM Plugin to version 5.3.2.0 or later immediately.

Proactive Monitoring: Monitor server logs for unauthorized symlink creation or suspicious access patterns originating from user-level web shells or FTP accounts.

Compensating Controls: Ensure that CloudLinux/CageFS restrictions are fully enabled and properly configured to limit the scope of potential symlink-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, this vulnerability has been confirmed as exploited in the wild during May 2026. Immediate patching is mandatory to prevent ongoing unauthorized access.

Analyst Recommendation

This vulnerability is being actively exploited, making it a top-priority security concern. Organizations utilizing the LiteSpeed cPanel plugin on shared hosting platforms must apply the provided updates immediately to mitigate the risk of data exfiltration and unauthorized escalation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw (Linux/macOS)
AFFECTED_VERSIONS: OpenClaw before 2026.5.12
---END_METADATA---

Description Summary:
A vulnerability in OpenClaw for Linux and macOS allows attackers to bypass argument pattern validation, enabling the execution of disallowed arguments in allowlisted executables.

Executive Summary:
A security flaw in OpenClaw on Linux and macOS permits attackers to bypass argument validation, potentially allowing the execution of unauthorized commands.

Vulnerability Details

CVE-ID: CVE-2026-53853

Affected Software: OpenClaw

Affected Versions: OpenClaw before 2026.5.12

Vulnerability: The issue resides in the exec allowlist mechanism, which fails to properly validate argument patterns. This allows a malicious actor to circumvent existing security policies and pass prohibited arguments to authorized executables on Linux and macOS platforms.

Business Impact

The CVSS score of 8.3 indicates high severity. By bypassing command execution constraints, attackers may be able to perform unauthorized system operations or escalate privileges, resulting in potential system compromise and violation of security policies.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.12 or later to ensure proper enforcement of argument pattern validation.

Proactive Monitoring: Review system execution logs for unexpected or anomalous arguments passed to allowlisted executables that may indicate an attempt to bypass security controls.

Compensating Controls: Use host-based intrusion detection systems (HIDS) to monitor and alert on unauthorized command-line executions or unusual process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability undermines the security controls meant to restrict executable arguments. It is imperative that all affected Linux and macOS deployments are updated to version 2026.5.12 to restore the integrity of the execution allowlist.

---METADATA---
VENDOR: Linux
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A race condition or improper cleanup vulnerability in the Linux kernel's VFIO PCI driver can occur during device shutdown if DMABUFs are not properly cleaned before the function is disabled.

Executive Summary:
A critical vulnerability in the Linux kernel's VFIO PCI driver regarding improper DMABUF cleanup during device shutdown could lead to system instability or potential security compromises.

Vulnerability Details

CVE-ID: CVE-2026-53322

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: The issue arises from an incorrect execution order in vfio_pci_core_close_device(), where DMABUFs are not cleaned up before the device is disabled. This lack of proper resource management can lead to memory corruption or undefined behavior within the kernel.

Business Impact

Exploiting kernel-level vulnerabilities can result in a complete system crash (Denial of Service) or, in certain configurations, provide an attacker with the ability to execute arbitrary code with elevated privileges. The CVSS score of 8.8 highlights the critical nature of this flaw, as it directly impacts the stability and security of the underlying operating system.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your Linux distribution provider immediately.

Proactive Monitoring: Monitor system logs for kernel panics or crash dumps related to the vfio driver to identify potential exploitation attempts.

Compensating Controls: Limit access to hardware pass-through features and restrict the loading of unnecessary kernel modules to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities are of the highest priority due to the potential for full system compromise. IT administrators should schedule and perform reboots to apply kernel patches across all affected server and workstation environments as soon as possible.

---METADATA---
VENDOR: Linux Foundation
PRODUCT: Linux Kernel (enetc driver)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel enetc network driver related to improper DMA memory management.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel enetc driver may allow attackers to compromise system integrity or cause service outages.

Vulnerability Details

CVE-ID: CVE-2026-53300

Affected Software: Linux Foundation Linux Kernel (enetc driver)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue involves a potential DMA use-after-free condition within the NTMP (Network Traffic Management Protocol) implementation of the enetc driver. This vulnerability is triggered by improper handling of memory objects, potentially allowing an authenticated attacker to trigger memory corruption.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a high risk to organizational infrastructure. If successfully exploited, it could lead to unauthorized memory access or persistent service disruption, impacting the reliability of network-facing critical systems.

Remediation Plan

Immediate Action: Apply the latest kernel security patches provided by your Linux distribution maintainer to address the enetc driver flaw.

Proactive Monitoring: Review kernel logs for memory-related errors or recurring crashes associated with networking hardware.

Compensating Controls: Ensure that network interfaces are isolated via VLANs and that high-privilege services are restricted from direct hardware interaction where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of use-after-free vulnerabilities in kernel space necessitates prompt action. Administrators should verify the patch status of their kernel versions and deploy updates as soon as they are made available by their vendor to mitigate the risk of exploitation.

---METADATA---
VENDOR: Linux Foundation
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A resource management flaw in the Linux kernel drm/xe driver allows for a potential use-after-free condition due to improper ordering of device cleanup during stream closure.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel's drm/xe driver could lead to system instability or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-53290

Affected Software: Linux Foundation Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in xe_eu_stall_stream_close() where drm_dev_put() is invoked before the stream is properly disabled, leading to a race condition. This flaw is exploitable by a local authenticated user capable of interacting with the DRM subsystem.

Business Impact

Successful exploitation of this memory corruption vulnerability could result in a kernel panic, causing significant service disruption. Given the CVSS score of 7.8, it poses a substantial risk to system availability and integrity, potentially allowing a local attacker to escalate privileges or crash the host environment.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest stable release provided by your distribution vendor that includes the fix for the drm/xe driver.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults specifically related to the xe driver or DRM subsystems.

Compensating Controls: Restrict access to DRM device nodes to only authorized users and services to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to kernel stability. Security teams should prioritize patching affected Linux distributions as part of their regular maintenance cycle to prevent local privilege escalation and system denial-of-service scenarios.

---METADATA---
VENDOR: Linux
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Linux kernel Btrfs file system handling causes improper dirty page management during transaction aborts, potentially leading to system instability.

Executive Summary:
A critical stability and security flaw in the Linux kernel Btrfs implementation requires immediate kernel updates to prevent potential system crashes and emergency shutdowns.

Vulnerability Details

CVE-ID: CVE-2026-53284

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the Btrfs file system driver, specifically concerning the release of dirty pages in the IO tree during transaction aborts. This issue can be triggered by specific disk operations, leading to kernel warnings and potential emergency system shutdowns.

Business Impact

The CVSS score of 7.5 highlights the impact on system availability, which is critical for server infrastructure. Successful exploitation or accidental triggering of this flaw causes denial-of-service conditions, leading to unplanned downtime and potential data loss if transactions are not committed correctly.

Remediation Plan

Immediate Action: Update the Linux kernel to a version containing the upstream fix for the Btrfs dirty page management issue.

Proactive Monitoring: Monitor kernel logs (dmesg) for "BTRFS critical" or "emergency shutdown" messages that indicate the system is hitting this specific vulnerability.

Compensating Controls: Ensure robust backup procedures are in place for systems utilizing Btrfs, and consider moving mission-critical workloads to alternative file systems if patching is delayed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators must prioritize patching kernels running the Btrfs file system. Given the potential for system-wide crashes, testing updates in a staging environment before widespread production deployment is recommended to ensure stability post-remediation.

---METADATA---
VENDOR: Linux Foundation
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management flaw in the Linux kernel iommu/vt-d subsystem could lead to NULL pointer dereferences or reference count corruption.

Executive Summary:
A high-severity memory corruption vulnerability in the Linux kernel's IOMMU subsystem poses a significant risk of system instability and potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-53281

Affected Software: Linux Foundation Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the iommu/vt-d driver where improper handling of pointer references can result in a NULL pointer dereference or refcount corruption. The vulnerability is local and requires an attacker to have the ability to interact with kernel-level IOMMU operations.

Business Impact

Successful exploitation of this flaw can lead to kernel panics, resulting in system-wide denial-of-service (DoS) conditions. Given the CVSS score of 8.8, the potential for memory corruption also suggests that an attacker might achieve arbitrary code execution within the kernel context, leading to full system compromise and loss of data integrity.

Remediation Plan

Immediate Action: Apply the latest kernel security patches provided by your Linux distribution vendor as soon as they become available.

Proactive Monitoring: Monitor system logs (dmesg) for kernel oops, segmentation faults, or abnormal IOMMU-related error messages that may indicate an exploitation attempt.

Compensating Controls: Restrict access to system interfaces that interact with IOMMU configurations and ensure that only authorized users have administrative or root privileges to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the stability and security of the underlying OS infrastructure. Organizations should prioritize updating their Linux kernel versions as part of their next scheduled maintenance cycle or sooner if the systems are exposed to untrusted local users.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An off-by-one error in the Linux kernel's Rockchip camera interface driver allows for out-of-bounds memory access.

Executive Summary:
An off-by-one vulnerability in the Linux kernel Rockchip driver poses a significant risk of memory corruption or system instability.

Vulnerability Details

CVE-ID: CVE-2026-52907

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an out-of-bounds memory access vulnerability within the rkcif driver, caused by incorrect array boundary comparisons. The issue requires local access to the affected hardware/driver context, typically by an authenticated user or process.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high severity. Successful exploitation could lead to local privilege escalation or kernel-level memory corruption, resulting in system crashes or the potential for unauthorized code execution, directly impacting system availability and integrity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer to address the rkcif off-by-one bug.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected segmentation faults that may indicate attempts to trigger memory corruption.

Compensating Controls: Restrict access to the camera interface or associated device nodes to only necessary system users to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for kernel-level impact, administrators should prioritize updating the Linux kernel to the patched version as soon as it becomes available in their distribution’s repository. Testing in a staging environment is advised to ensure compatibility before deploying to production systems.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions affected by commit 1f3e4142c0eb, fixed in 7.0.4-1, 7.0.10-1, 5.10.257-1, 6.1.174-1, and 6.12.90-2.
---END_METADATA---

Description Summary:
A flaw in the Linux kernel 9p module causes incorrect access mode flag handling, leading to privilege escalation issues during file system operations.

Executive Summary:
A vulnerability in the Linux kernel's 9p module could allow for unauthorized privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-52906

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions affected by commit 1f3e4142c0eb, fixed in 7.0.4-1, 7.0.10-1, 5.10.257-1, 6.1.174-1, and 6.12.90-2.

Vulnerability: This is a logic error where the 9p module incorrectly ORs access mode flags instead of replacing them. This causes v9fs_fid_lookup() to use INVALID_UID instead of the correct user ID, preventing root users from performing privileged operations like chown.

Business Impact

The vulnerability carries a CVSS score of 7.7, placing it in the High severity range. Successful exploitation compromises the integrity of file system operations and can lead to unauthorized access or administrative failure, potentially disrupting critical services relying on the 9p file system protocol.

Remediation Plan

Immediate Action: Update the Linux kernel to the versions specified in the patch list: 7.0.4-1, 7.0.10-1, 5.10.257-1, 6.1.174-1, or 6.12.90-2.

Proactive Monitoring: Monitor system logs for unexpected errors related to file ownership changes or 9p mount operations.

Compensating Controls: If patching is delayed, restrict access to the 9p file system by untrusted users and enforce strict kernel security policies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity and the core nature of the kernel component, organizations should prioritize patching the Linux kernel across all affected environments. Immediate application of the provided security updates is required to mitigate the risk of privilege escalation.

---METADATA---
VENDOR: vm2
PRODUCT: vm2
AFFECTED_VERSIONS: vm2 prior to version 3.11.4, or versions up to 3.11.3.
---END_METADATA---

Description Summary:
An incomplete denylist of Node.js builtins in vm2 allows unauthenticated attackers to escape the sandbox and execute code in the host process.

Executive Summary:
A critical vulnerability in vm2 (versions up to 3.11.3) permits unauthenticated attackers to escape the sandbox by exploiting missing restrictions on sensitive Node.js builtins.

Vulnerability Details

CVE-ID: CVE-2026-47140

Affected Software: vm2 (vm2)

Affected Versions: vm2 prior to version 3.11.4, or versions up to 3.11.3.

Vulnerability: The NodeVM sandbox fails to sufficiently restrict access to sensitive built-in modules, specifically 'process' and 'inspector/promises'. These modules provide unauthenticated attackers with primitives necessary to interact with the host-side environment, effectively bypassing all sandbox isolation.

Business Impact

The ability to access host-side execution primitives from within a sandbox renders the isolation provided by vm2 ineffective. With a CVSS score of 10.0, this vulnerability allows for full system compromise, posing a major risk of unauthorized data access, privilege escalation, and persistent threats to the underlying host infrastructure.

Remediation Plan

Immediate Action: Upgrade vm2 to version 3.11.4 to incorporate the updated denylist and restrict access to dangerous Node.js builtins.

Proactive Monitoring: Audit application code for any usage of dangerous modules and monitor system logs for signs of anomalous process execution originating from sandboxed environments.

Compensating Controls: If upgrading is delayed, use system-level policies (e.g., AppArmor or SELinux) to restrict the capabilities of the process running the vm2 sandbox.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While no public exploits are currently identified, the severity of a sandbox breakout via built-in modules is extreme. Organizations must prioritize the update to version 3.11.4 to ensure that sandbox boundaries are properly enforced against known dangerous primitives.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel builds including the greybus driver prior to specified commits.
---END_METADATA---

Description Summary:
A buffer overflow exists in the Linux kernel's greybus driver, specifically within the cc1352_bootloader_rx function, due to missing bounds checks on receive buffers.

Executive Summary:
A critical buffer overflow vulnerability in the Linux kernel's greybus module could allow an attacker to trigger memory corruption or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-46332

Affected Software: Linux Kernel

Affected Versions: Linux kernel builds that include the greybus driver (used on BeaglePlay and similar devices) prior to fixes in commits 0339a746ff7cd3f9d10f565e89c99dc93191e58d, 1214bf28965ceaf584fb20d357731264dd2e10e1, 663c2728a6d0f781044431111b53a27f71027e48, fb91d4e49fcbea0b5091394ac5b8f7d4124265c3.

Vulnerability: This is a buffer overflow (CWE-120) in the cc1352_bootloader_rx() function. The driver fails to validate the size of incoming data chunks before appending them to a fixed-size buffer, allowing a remote or local attacker with access to the bootloader UART interface to overflow the buffer.

Business Impact

With a CVSS score of 8.0, this vulnerability presents a significant risk of arbitrary memory corruption or potential code execution. Successful exploitation could lead to full system compromise, particularly on devices utilizing the BeaglePlay platform. The risk is elevated by the potential for remote exploitation if the UART interface is exposed.

Remediation Plan

Immediate Action: Update the Linux kernel to a version that includes the necessary bounds checks (referenced by the identified upstream commits).

Proactive Monitoring: Inspect system configurations to identify devices running the affected greybus driver and restrict physical or logical access to the associated UART interfaces.

Compensating Controls: Implement strict input validation or device-level firewalls if the UART interface is used for communication with untrusted components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw makes it a high-priority target for an attacker with local access.

Analyst Recommendation

Given the potential for code execution, this vulnerability warrants an urgent update. Organizations using devices equipped with the greybus driver should apply the kernel patches immediately to prevent unauthorized memory manipulation and potential system takeover.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel necessitated the reversion of the TCP ULP (Upper Layer Protocol) support feature for SMC (Shared Memory Communications).

Executive Summary:
The Linux kernel has reverted the TCP ULP support feature for SMC to address a critical flaw, and users should update to prevent potential instability.

Vulnerability Details

CVE-ID: CVE-2026-46330

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The implementation of TCP ULP support for SMC was found to be fundamentally flawed, leading to the total reversion of the feature (commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40). Failure to remove this code leaves the kernel in a state susceptible to undefined behavior or security regressions.

Business Impact

Given the CVSS score of 7.8, this issue is considered high-risk. The inclusion of faulty ULP logic can expose the networking stack to unexpected behaviors that could be leveraged for system compromise or denial of service, impacting overall system reliability.

Remediation Plan

Immediate Action: Upgrade your Linux kernel to the version that includes the reversion of the affected TCP ULP support code.

Proactive Monitoring: Review system logs for networking-related errors, specifically those involving SMC or ULP socket configurations.

Compensating Controls: If immediate patching is not feasible, disable SMC support if it is not required for your specific network architecture.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should audit their environment for the presence of the faulty ULP implementation. Updating the kernel to a version that properly reverts this feature is essential to maintain a stable and secure network environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Amazon Linux: Kernel-5.10 Extra (Pending Fix), Kernel-5.15 Extra (Pending Fix), Amazon Linux 2023 (kernel, kernel6.12, kernel6.18 - Pending Fix). Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.
---END_METADATA---

Description Summary:
An AppArmor security module flaw in the Linux kernel allows local attackers to bypass resource limits for POSIX CPU timers.

Executive Summary:
A vulnerability in the Linux kernel AppArmor module allows for the bypass of CPU resource limits, potentially leading to unauthorized resource consumption.

Vulnerability Details

CVE-ID: CVE-2026-46328

Affected Software: Linux Kernel

Affected Versions: Amazon Linux: Kernel-5.10 Extra (Pending Fix), Kernel-5.15 Extra (Pending Fix), Amazon Linux 2023 (kernel, kernel6.12, kernel6.18 - Pending Fix). Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.

Vulnerability: The AppArmor security module incorrectly enforces rlimit for POSIX CPU timers. This failure allows a local, authenticated user to bypass intended CPU time restrictions, leading to excessive resource consumption.

Business Impact

With a CVSS score of 7.3, this flaw poses a notable risk to multi-tenant environments and shared hosting platforms. An attacker can circumvent security policies to consume disproportionate CPU resources, negatively impacting the performance of other services or applications running on the same host.

Remediation Plan

Immediate Action: Monitor vendor security bulletins and apply the kernel patches as soon as they become available for your specific distribution.

Proactive Monitoring: Monitor system logs and resource usage for unusual CPU activity or processes exceeding expected operational boundaries.

Compensating Controls: Use alternative cgroup-based resource constraints or hardware-level partitioning to enforce resource limits until the kernel patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this is a local privilege/resource bypass, it remains a serious concern for security-sensitive environments. Administrators should track the availability of the upstream kernel fix and schedule deployment across all affected Linux systems to restore proper resource enforcement.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unlocked check in the Linux kernel’s device mapper (dm) component can lead to race conditions during device suspension state verification.

Executive Summary:
An unlocked state-check vulnerability in the Linux kernel's device mapper could lead to inconsistent kernel state and potential system instability.

Vulnerability Details

CVE-ID: CVE-2026-46327

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The function dm_blk_report_zones performs an unlocked test for the dm_suspended_md status. Because the check is performed without appropriate locking, the state of the device mapper can change during the check, leading to race conditions.

Business Impact

With a CVSS score of 7.8, this flaw presents a substantial risk to systems relying on the device mapper for storage management. An attacker capable of triggering this race condition could cause a kernel panic or potentially interfere with storage I/O, leading to data unavailability or system-wide denial of service.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch to ensure proper locking is enforced during the dm_suspended_md check.

Proactive Monitoring: Monitor storage subsystem logs for I/O errors or unexpected device-mapper related kernel warnings.

Compensating Controls: Ensure that sensitive storage operations are managed by privileged administrative accounts to limit the potential for unauthorized triggering of the vulnerable code path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Storage subsystem integrity is paramount for system availability. Organizations should treat this vulnerability with high priority, ensuring that kernel updates are validated and deployed to all servers managing storage volumes via the device mapper.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 7.0-rc1
---END_METADATA---

Description Summary:
An improper initialization vulnerability exists in the Linux kernel's mprls0025pa pressure driver, which fails to zero out the spi_transfer structure before use.

Executive Summary:
A memory initialization vulnerability in the Linux kernel mprls0025pa driver poses a high security risk by potentially exposing uninitialized memory or triggering system instability.

Vulnerability Details

CVE-ID: CVE-2026-46326

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 7.0-rc1 (fixed by commit 1e0ac56c92e26115cbc8cfc639843725cb3a7d6a).

Vulnerability: This is an improper initialization flaw in the iio: pressure: mprls0025pa driver. Because the spi_transfer structure is not consistently zeroed out before use, an attacker could potentially read sensitive information from uninitialized memory or trigger unpredictable system behavior, leading to a Denial of Service (DoS).

Business Impact

With a CVSS score of 8.4, this vulnerability is categorized as High severity. The potential for information disclosure or system-wide denial of service could impact the confidentiality and availability of critical infrastructure running affected kernel versions. If exploited, the instability of the kernel could lead to unexpected downtime for production systems.

Remediation Plan

Immediate Action: Update the Linux kernel to a version containing the fix, specifically commit 1e0ac56c92e26115cbc8cfc639843725cb3a7d6a (included in 7.0-rc1).

Proactive Monitoring: Monitor system logs for kernel panics or unusual driver-related errors that may indicate exploitation attempts or instability.

Compensating Controls: Ensure kernel hardening features such as Address Space Layout Randomization (ASLR) are enabled to increase the difficulty of exploiting memory-related vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its location within the kernel, the potential for exploitation is high.

Analyst Recommendation

Given the severity of kernel-level vulnerabilities, administrators should prioritize patching as soon as the upstream fix is integrated into their specific distribution's kernel updates. Immediate application of the kernel patch is necessary to mitigate the risk of memory disclosure and potential system crashes.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A concurrency issue in the Linux kernel's netfilter/nf_tables component occurs due to incorrect list deletion methods during netlink hook unregistration.

Executive Summary:
A race condition in the Linux kernel's netfilter subsystem could allow concurrent processes to access invalid memory, risking system stability.

Vulnerability Details

CVE-ID: CVE-2026-46324

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The functions nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks utilize an incorrect list deletion method, failing to safely handle concurrent dumpers. This vulnerability allows for a race condition when managing netlink hooks, potentially leading to memory corruption.

Business Impact

The CVSS score of 7.8 underscores the severity of this vulnerability, which affects the kernel's core networking and filtering capabilities. Exploitation could lead to system instability, denial of service, or potentially lead to arbitrary code execution if an attacker can reliably trigger the race condition.

Remediation Plan

Immediate Action: Upgrade to the latest kernel release that includes the corrected list_del_rcu implementation for netfilter hooks.

Proactive Monitoring: Monitor for kernel-level crashes or segmentation faults specifically originating from netfilter or netlink-related operations.

Compensating Controls: Restrict access to nf_tables configuration (e.g., CAP_NET_ADMIN) to trusted processes to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the complexity of kernel synchronization. Security teams must ensure that systems utilizing advanced netfilter configurations are updated promptly, as the potential for local exploitation of race conditions in these subsystems is significant.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper check in the Linux kernel’s GRO (Generic Receive Offload) implementation allows for the merging of zerocopy skbs, potentially violating memory management constraints.

Executive Summary:
A flaw in the Linux kernel's networking stack could allow improper merging of zerocopy network buffers, posing a risk to system memory integrity.

Vulnerability Details

CVE-ID: CVE-2026-46323

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The skb_gro_receive function fails to verify the SKBFL_MANAGED_FRAG_REFS flag when merging zerocopy skbs. This oversight allows improper handling of fragment references, which can lead to memory corruption or inconsistent state within the networking subsystem.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a high-risk security threat. Exploitation could lead to kernel-level memory corruption, resulting in service interruption or the potential for local privilege escalation, necessitating urgent attention for systems handling high-volume network traffic.

Remediation Plan

Immediate Action: Update the Linux kernel to the version provided by your distribution that specifically addresses the skb_gro_receive zerocopy merging logic.

Proactive Monitoring: Review system stability metrics and watch for intermittent networking stack failures or abnormal kernel memory usage patterns.

Compensating Controls: Implement strict network ingress filtering to reduce the likelihood of specially crafted packets reaching the vulnerable GRO processing path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities involving memory management in the networking stack are critical. Organizations should verify their kernel version against vendor security bulletins and deploy the necessary updates as soon as they are available to mitigate the risk of memory corruption.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Microsoft Azure Linux kernel version 3.0. Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.
---END_METADATA---

Description Summary:
A memory leak in the Linux kernel's tun driver during build_skb() failures allows for potential denial-of-service attacks.

Executive Summary:
A failure to properly handle memory in the Linux kernel's tun driver creates a memory leak vulnerability that threatens system availability.

Vulnerability Details

CVE-ID: CVE-2026-46322

Affected Software: Linux Kernel

Affected Versions: Microsoft Azure Linux kernel version 3.0. Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.

Vulnerability: This vulnerability resides in the tun_xdp_one() function, where a failure in build_skb() results in an error path that skips freeing an allocated memory page. Repeated triggering of this failure leads to memory exhaustion and system instability.

Business Impact

With a CVSS score of 7.1, this vulnerability presents a significant risk to the availability of Linux-based systems. Memory exhaustion attacks can be difficult to diagnose, and their impact on system performance can lead to widespread service disruption across the affected infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch that ensures memory pages are freed appropriately when an error occurs in the tun_xdp_one() function.

Proactive Monitoring: Use system monitoring tools to track memory allocation patterns, specifically looking for leaks associated with network driver error paths.

Compensating Controls: Restrict access to tun/tap device management to privileged users only to minimize the risk of an attacker intentionally triggering this error path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize this patch alongside other kernel updates. Ensuring that error-handling paths within the Linux kernel are secure is vital for maintaining the resilience of network-intensive systems against denial-of-service attacks.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Microsoft Azure Linux kernel version 3.0. Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.
---END_METADATA---

Description Summary:
A memory leak in the Linux kernel's tun driver allows local attackers to cause a denial of service by triggering short-frame rejections.

Executive Summary:
A memory leak in the Linux kernel tun driver exposes systems to denial-of-service via memory exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-46321

Affected Software: Linux Kernel

Affected Versions: Microsoft Azure Linux kernel version 3.0. Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.

Vulnerability: A vulnerability in the tun_xdp_one() function fails to free memory pages when rejecting network frames shorter than the expected Ethernet header length. This allows a local attacker with access to the tun/tap device to leak memory through repeated exploitation.

Business Impact

The CVSS score of 7.1 indicates a high risk to availability. By triggering this memory leak, an attacker can exhaust system memory, potentially forcing a kernel panic or causing a total system denial of service, which disrupts all hosted applications.

Remediation Plan

Immediate Action: Update the Linux kernel to the version containing the fix, which ensures the page is freed before returning an error.

Proactive Monitoring: Monitor for kernel-level memory leaks and unexpected increases in memory usage associated with tun/tap device activity.

Compensating Controls: Limit access to tun/tap interfaces to only necessary services and users, utilizing SELinux or AppArmor policies to restrict device access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities leading to memory exhaustion are critical for system uptime. Administrators should apply the provided patch as soon as possible, particularly on systems that heavily rely on virtual networking or tunneling, to prevent potential DoS scenarios.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Debian: linux (bullseye 5.10.223-1, bullseye (security) 5.10.257-1, bookworm 6.1.170-3, bookworm (security) 6.1.174-1, trixie 6.12.86-1, trixie (security) 6.12.90-2, forky sid 7.0.10-1). Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.
---END_METADATA---

Description Summary:
A memory leak in the Linux kernel's tap driver's tap_get_user_xdp() function can lead to system-wide resource exhaustion and denial of service.

Executive Summary:
A memory leak in the Linux kernel tap driver exposes systems to potential denial-of-service conditions through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-46320

Affected Software: Linux Kernel

Affected Versions: Debian: linux (bullseye 5.10.223-1, bullseye (security) 5.10.257-1, bookworm 6.1.170-3, bookworm (security) 6.1.174-1, trixie 6.12.86-1, trixie (security) 6.12.90-2, forky sid 7.0.10-1). Red Hat: All previous versions of packages in any minor update stream of a product listed as vulnerable.

Vulnerability: A flaw in the tap_get_user_xdp() function fails to properly free memory pages when processing rejected network frames. This occurs when frames are shorter than the Ethernet header length or during failed memory allocations, leading to a persistent memory leak.

Business Impact

The CVSS score of 7.4 underscores a high risk to system stability. Because the Linux kernel is foundational to infrastructure, this vulnerability could be leveraged to degrade or crash critical services by exhausting memory, resulting in significant operational downtime.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor (e.g., Debian or Red Hat).

Proactive Monitoring: Monitor kernel memory usage and look for signs of memory fragmentation or depletion that could indicate a leak in the tap/xdp subsystems.

Compensating Controls: Restrict access to network interfaces and tap/tun devices to authorized users or containers only to limit the attack surface for triggering these error paths.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This kernel-level vulnerability warrants an urgent update cycle. Security teams should ensure that all Linux distributions managing network-intensive workloads are patched to the versions addressing this memory leak to maintain system integrity and prevent denial-of-service attacks.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition exists in the Linux kernel's net/sched: act_ct component due to improper RCU read lock handling during flow table lookups.

Executive Summary:
A concurrency vulnerability in the Linux kernel's network scheduling subsystem could potentially lead to memory corruption or system instability.

Vulnerability Details

CVE-ID: CVE-2026-46319

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises in the tcf_ct_flow_table_get function where rhashtable_lookup_fast prematurely closes an RCU read critical section. This flaw allows for potential use-after-free or race conditions, typically requiring local access or specific network traffic triggers.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high risk to system availability and integrity. Successful exploitation could result in kernel panics, system crashes, or unauthorized memory access, causing significant operational downtime for mission-critical infrastructure running affected kernel versions.

Remediation Plan

Immediate Action: Apply the latest security patches provided by your Linux distribution vendor to resolve the RCU locking issue.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts related to the networking stack.

Compensating Controls: Utilize kernel hardening modules and ensure that untrusted users are restricted from triggering complex network scheduling operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of kernel-level vulnerabilities, administrators should prioritize patching during the next maintenance cycle. Ensure that all production environments are updated to a kernel version that incorporates the fix for act_ct locking issues to prevent potential stability and security compromises.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the Linux kernel KVM for arm64 allows a local attacker to access freed memory via improper reassignment of the nested_mmus array.

Executive Summary:
A high-severity memory corruption flaw in the Linux kernel KVM implementation for arm64 architectures could allow a local attacker to escalate privileges or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-46317

Affected Software: Linux kernel

Affected Versions: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.

Vulnerability: This is a memory corruption vulnerability stemming from the improper reassignment of the nested_mmus array within the KVM subsystem. The issue allows a local process to access memory that has already been freed, leading to potential security bypasses.

Business Impact

The CVSS score of 8.8 reflects the high risk of this kernel-level vulnerability. A local attacker can exploit this to achieve privilege escalation, potentially gaining root access to the host machine. Furthermore, the vulnerability can be used to trigger a kernel panic, leading to system-wide denial-of-service, which is particularly critical for server environments.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor (e.g., Red Hat).

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system instability following the execution of virtualization workloads.

Compensating Controls: Restrict access to the system to authorized users only, specifically limiting the ability to initiate KVM/virtualization processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities of this nature should be treated with the highest priority. Administrators should test and deploy the provided kernel updates across all affected RHEL environments as soon as possible to mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions affected by an out-of-bounds write in the ath5k Wi-Fi driver.
---END_METADATA---

Description Summary:
The Linux kernel's ath5k Wi-Fi driver contains an array-index-out-of-bounds vulnerability that results in a minor out-of-bounds write.

Executive Summary:
An out-of-bounds write vulnerability in the Linux kernel ath5k driver presents a memory safety risk, though the practical impact is currently limited.

Vulnerability Details

CVE-ID: CVE-2026-46307

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions affected by an out-of-bounds write in the ath5k Wi-Fi driver. SUSE lists fixed packages as kernel-devel >= 7.0.12-1.1.

Vulnerability: The ath5k Wi-Fi driver performs an array-index-out-of-bounds access. This memory safety flaw results in a small out-of-bounds write that can corrupt an adjacent status field within the driver's memory.

Business Impact

Despite a CVSS score of 8.3, the vulnerability has a relatively minor practical effect, primarily limited to the corruption of an internal status field. However, memory safety issues in the kernel are inherently dangerous, as they can theoretically be weaponized to bypass security mitigations. Maintaining system integrity requires addressing these bugs to prevent unauthorized memory modification.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates, specifically ensuring the kernel is updated to at least the version provided by your distribution (e.g., SUSE kernel-devel >= 7.0.12-1.1).

Proactive Monitoring: Review kernel logs for UBSAN (Undefined Behavior Sanitizer) alerts or driver-related errors that may indicate the vulnerability is being triggered.

Compensating Controls: Restrict access to wireless network configurations and utilize secure hardware configurations to minimize the attack surface of wireless drivers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. No known exploit chain is being passed around by threat actors.

Analyst Recommendation

While the impact is currently considered localized, kernel vulnerabilities should never be ignored due to the risk of privilege escalation. Organizations should schedule the deployment of the relevant kernel updates during the next maintenance window to ensure long-term system stability and security.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Linux kernel's flow dissector incorrectly handles PPPoE Protocol Field Compression (PFC) frames, contrary to RFC 2516 recommendations.

Executive Summary:
Improper handling of PPPoE PFC frames in the Linux kernel flow dissector may result in network traffic processing errors or system instability.

Vulnerability Details

CVE-ID: CVE-2026-46306

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flow dissector component attempts to process PFC frames which are explicitly discouraged by RFC 2516. This flaw can be triggered by specifically crafted network packets, potentially leading to incorrect traffic routing or kernel-level processing errors.

Business Impact

The CVSS score of 7.5 classifies this as a high-severity issue. Successful exploitation could disrupt network traffic flow, degrade network performance, or create conditions for a local denial-of-service, impacting the business's ability to maintain reliable network connectivity.

Remediation Plan

Immediate Action: Patch the Linux kernel to the version that excludes PPPoE PFC frames from the flow dissector.

Proactive Monitoring: Utilize network monitoring tools to identify anomalous traffic patterns or high packet drop rates that could indicate attempts to exploit the flow dissector.

Compensating Controls: Deploy network-level firewalls or ingress filtering to drop malformed PPPoE frames before they reach the kernel's processing stack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network stability is critical for business operations; therefore, updating the kernel to properly handle PPPoE frames is essential. Administrators should prioritize this patch, especially in environments handling high volumes of PPPoE-encapsulated traffic.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A recursive flushing issue in the Linux kernel NVMe-over-TCP target code can lead to a deadlock or system instability during controller release.

Executive Summary:
A recursive reference counting flaw in the Linux kernel NVMe-over-TCP implementation creates a risk of system deadlock.

Vulnerability Details

CVE-ID: CVE-2026-46304

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the nvmet_ctrl_free function, where recursive workqueue flushing can occur during the controller release process. This is a local denial-of-service vulnerability requiring interaction with the NVMe target subsystem.

Business Impact

With a CVSS score of 7.5, this high-severity vulnerability threatens the stability of storage infrastructure. Exploitation could lead to persistent kernel deadlocks, resulting in significant service downtime and loss of access to storage resources for dependent applications.

Remediation Plan

Immediate Action: Update the Linux kernel to a version containing the fix for the nvmet recursive flush issue.

Proactive Monitoring: Review system logs for kernel-level stalls or hang conditions specifically related to NVMe-over-TCP controller operations.

Compensating Controls: In high-availability environments, ensure that storage failover mechanisms are tested and functional to mitigate the impact of potential kernel panics.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant stability risk for systems utilizing NVMe-over-TCP. Organizations should integrate the relevant kernel updates into their maintenance cycle immediately to prevent potential service interruptions caused by kernel-level deadlocks.

---METADATA---
VENDOR: Linux Foundation
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A validation flaw in the Linux kernel's isofs filesystem driver allows an attacker to provide a crafted ISO image that triggers out-of-bounds memory access.

Executive Summary:
A vulnerability in the Linux kernel's isofs component could allow an attacker to perform out-of-bounds memory access via a maliciously crafted ISO 9660 filesystem.

Vulnerability Details

CVE-ID: CVE-2026-46303

Affected Software: Linux Kernel

Affected Versions: See vendor advisory

Vulnerability: The isofs filesystem driver fails to validate the rs->cont_extent field from Rock Ridge CE records against the volume size. This allows a crafted ISO image to force the kernel to read blocks outside the intended range, potentially accessing sensitive data from adjacent filesystems.

Business Impact

The CVSS score of 8.2 (High) signifies a serious risk for systems that mount untrusted ISO images. Successful exploitation could lead to information disclosure or system instability, potentially exposing memory or data from other mounted volumes or system processes.

Remediation Plan

Immediate Action: Apply the kernel patch that adds an ISOFS_SB(sb)->s_nzones bounds check to the rock_continue() function.

Proactive Monitoring: Review system logs for kernel panics or filesystem errors when mounting external media or disk images.

Compensating Controls: Implement strict policies regarding the mounting of untrusted or externally sourced ISO images on production Linux systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should update their Linux kernel versions as soon as vendor-supplied patches become available for their specific distributions. Until patches are applied, avoid mounting ISO images from untrusted or unverified sources.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management flaw in the Linux kernel skb_try_coalesce function allows for improper handling of shared-frag markers during coalescing.

Executive Summary:
A memory management vulnerability in the Linux kernel network subsystem could lead to system instability or potential memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-46300

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs in the network subsystem's skb_try_coalesce function, where improper handling of shared-frag markers during buffer coalescing can occur. This typically requires a local authenticated user or specific network traffic conditions to trigger, depending on the kernel configuration.

Business Impact

Successful exploitation of this kernel-level flaw could result in a denial-of-service (DoS) condition or potential privilege escalation. Given the CVSS score of 7.8, this vulnerability is classified as High, reflecting the significant risk of system compromise if an attacker can manipulate kernel memory structures.

Remediation Plan

Immediate Action: Apply the latest security patches provided by your Linux distribution vendor to address the kernel vulnerability.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts that may indicate memory-related instability.

Compensating Controls: Ensure kernel hardening features like KASLR and SMEP/SMAP are enabled to limit the success of potential memory-based exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity and availability of Linux-based systems. Administrators are strongly advised to prioritize the application of kernel updates as part of their standard patch management cycle to mitigate potential exploitation.

---METADATA---
VENDOR: Linux Foundation
PRODUCT: Linux Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management flaw in the Linux kernel HFS+ filesystem driver causes an improper release of a held spinlock during the filesystem mounting process.

Executive Summary:
A vulnerability in the Linux kernel HFS+ implementation could lead to a kernel-level deadlock or system instability if an attacker mounts a malformed filesystem.

Vulnerability Details

CVE-ID: CVE-2026-46299

Affected Software: Linux Foundation Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an improper lock management issue within the hfsplus_fill_super() function. An authenticated local user or an attacker capable of triggering a filesystem mount could cause a kernel lock to be freed while still held, resulting in a system crash or potential denial-of-service.

Business Impact

The exploitation of this vulnerability poses a significant risk to system availability. Given the CVSS score of 7.0, it is classified as a High-severity issue that could lead to kernel panics and unexpected system reboots, causing critical service disruptions. While primarily a local attack vector, the instability introduced by this flaw could be leveraged to disrupt mission-critical infrastructure running on affected Linux distributions.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest stable version provided by your distribution vendor as soon as the security patch is released.

Proactive Monitoring: Monitor system logs (dmesg or syslog) for kernel panic events, lockdep warnings, or recurring filesystem mount errors.

Compensating Controls: Restrict the ability to mount external or untrusted filesystems to authorized administrative users only, as this reduces the attack surface for this specific driver-level vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw occurring within the kernel memory management subsystem, the potential for local denial-of-service remains high.

Analyst Recommendation

The Linux kernel remains a primary target for local privilege escalation and system instability attacks. Administrators should prioritize patching this vulnerability as part of their standard maintenance cycle to ensure system uptime and kernel integrity. If the HFS+ driver is not required for your specific operational environment, consider blacklisting the hfsplus kernel module as a proactive measure until the official patch is applied.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: Linux kernel (Amazon Linux is not affected).
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel device tree unit test code allows a local attacker to crash the kernel or execute code with kernel privileges.

Executive Summary:
A use-after-free vulnerability in the Linux kernel’s device tree unit test mechanism presents a significant risk for local privilege escalation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-46288

Affected Software: Linux kernel

Affected Versions: Linux kernel (Amazon Linux is not affected).

Vulnerability: This use-after-free vulnerability occurs in the device tree unit test code, where the parent variable can reference a device node that has already been freed. This occurs because the of_node_put() call is incorrectly sequenced during the test.

Business Impact

With a CVSS score of 8.4, this vulnerability is highly severe. A local attacker capable of triggering the device tree unit test can exploit this memory management flaw to execute arbitrary code with kernel-level privileges. This results in complete system compromise and the ability to bypass all user-space security controls.

Remediation Plan

Immediate Action: Update the Linux kernel to a version that includes the patch ensuring of_node_put() is called only after all accesses to the parent variable are completed.

Proactive Monitoring: Monitor for suspicious attempts to interact with kernel debugging or unit test interfaces.

Compensating Controls: Disable unnecessary kernel debugging features and unit test modules in production environments to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel patches are critical for maintaining system integrity. Organizations should verify their current kernel versions against vendor advisories and apply the necessary updates to prevent local attackers from leveraging this memory management flaw to gain elevated control.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Use-After-Free vulnerability exists in the Linux kernel's test_hmm module, where failure to properly evict device pages on file close leads to insecure memory states.

Executive Summary:
A Use-After-Free vulnerability in the Linux kernel’s test_hmm module could allow an attacker to trigger memory corruption and potentially achieve code execution.

Vulnerability Details

CVE-ID: CVE-2026-46280

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists in the test_hmm (Heterogeneous Memory Management) test module. The kernel fails to properly evict device pages when a file is closed, resulting in a Use-After-Free condition that can be triggered by a local user.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a high risk to system stability and security. Exploitation could allow an attacker to gain elevated privileges or cause a Denial of Service by corrupting kernel memory structures associated with device management.

Remediation Plan

Immediate Action: Apply the vendor-provided security update to the Linux kernel to ensure proper memory management in the test_hmm module.

Proactive Monitoring: Monitor for unexpected kernel module behavior or errors related to memory management during file system operations.

Compensating Controls: If the test_hmm module is not needed for production, ensure it is blacklisted or not loaded by the kernel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this is a test module, vulnerabilities within the kernel space must be treated with high priority. Users are encouraged to apply the patch immediately to close this potential attack vector.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper memory access vulnerability exists in the Linux kernel's zone_device implementation, where the system may attempt to access a device folio after it has been freed.

Executive Summary:
An improper memory access flaw in the Linux kernel’s zone_device subsystem could lead to kernel memory corruption or unexpected system behavior.

Vulnerability Details

CVE-ID: CVE-2026-46277

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue resides in the mm/zone_device component. The kernel incorrectly accesses a device folio after the folio_free call has been executed, leading to a potential race condition where the memory may have been reallocated for different purposes.

Business Impact

This vulnerability carries a CVSS score of 7.8, reflecting the significant risk of memory corruption. Such flaws can lead to data leakage or system compromise if an attacker can influence the contents of the reallocated memory, potentially impacting the integrity of the host environment.

Remediation Plan

Immediate Action: Update the kernel to the latest version provided by your distribution, which includes the fix to prevent post-free access.

Proactive Monitoring: Monitor for kernel-level memory faults or instability in storage or memory management operations.

Compensating Controls: Implement strict kernel memory protection policies and ensure that security updates are applied to all kernel-dependent modules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel memory management vulnerabilities are inherently dangerous due to their potential for widespread system impact. Security teams should prioritize patching this vulnerability to maintain the integrity of the system's memory management operations.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Use-After-Free and Null Pointer Dereference vulnerability exists in the Linux kernel's Bluetooth hci_uart driver due to improper lifecycle management during initialization and termination.

Executive Summary:
Race conditions in the Linux kernel's Bluetooth hci_uart driver can lead to Use-After-Free or Null Pointer Dereference, potentially allowing for arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-46275

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a concurrency-related vulnerability involving the hci_uart module. The flaw stems from race conditions during the close and init paths, which can be triggered by a local attacker to manipulate memory states.

Business Impact

The ability to trigger UAF or NPD conditions in the kernel is a critical security concern. With a CVSS score of 7.8, this flaw could be exploited to crash the kernel or execute unauthorized code with elevated privileges, severely compromising the security of the host system.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch that addresses race conditions in the Bluetooth subsystem.

Proactive Monitoring: Review system logs for Bluetooth-related driver errors and frequent service restarts, which might indicate exploitation attempts.

Compensating Controls: Disable the Bluetooth subsystem if it is not strictly required for business operations to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for code execution and the complexity of race condition vulnerabilities, immediate patching is advised. Systems utilizing Bluetooth connectivity should be audited and updated as a matter of urgency to prevent potential exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A logic error exists in the Linux kernel io-wq component, where improper handling of hash bucket tails during work removal can lead to memory corruption.

Executive Summary:
A logic flaw in the Linux kernel's io-wq subsystem poses a risk of memory corruption, potentially leading to system instability or local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-46274

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a memory management flaw within the io_wq_remove_pending function. An attacker with local access could potentially leverage this flaw to trigger an out-of-bounds access or corruption, requiring authenticated access to the system.

Business Impact

Successful exploitation of this kernel-level vulnerability could result in a system crash (Denial of Service) or provide a mechanism for a local attacker to escalate privileges. Given the CVSS score of 7.8, this represents a high-severity risk to business continuity and data integrity, particularly for multi-user environments or containerized infrastructure.

Remediation Plan

Immediate Action: Identify systems running affected Linux kernel versions and apply the latest security patches provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual process termination patterns that may indicate memory corruption attempts.

Compensating Controls: Restrict local access to critical infrastructure and ensure that kernel hardening features (e.g., KASLR, SMEP/SMAP) are fully enabled to increase the difficulty of exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the necessity of maintaining up-to-date kernel versions in production environments. Administrators should prioritize the deployment of the vendor-supplied patch to mitigate the risk of local privilege escalation and system instability.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management error in the Linux kernel DRM/XE driver during sysfs initialization can result in improper cleanup actions on uninitialized objects.

Executive Summary:
A high-severity memory management flaw in the Linux kernel DRM/XE driver could potentially lead to system instability or security degradation due to improper resource handling.

Vulnerability Details

CVE-ID: CVE-2026-46264

Affected Software: Linux, Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs in the drm/xe/pf driver when devm_add_action_or_reset() fails. The cleanup logic attempts to operate on a kobject before it has been fully initialized, leading to inconsistent system states.

Business Impact

Kernel-level vulnerabilities are critical as they reside at the core of the operating system. With a CVSS score of 8.8, this flaw could potentially be leveraged for local privilege escalation or system crashes, resulting in significant operational downtime and potential compromise of system-wide security policies.

Remediation Plan

Immediate Action: Apply the latest Linux kernel security patches provided by your distribution vendor as soon as they become available.

Proactive Monitoring: Monitor system logs (dmesg, syslog) for kernel panic events, memory access violations, or driver-related initialization errors.

Compensating Controls: Maintain a minimal attack surface by disabling unnecessary kernel modules and ensuring that the system is running with hardened configurations (e.g., SELinux or AppArmor).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities require immediate attention to maintain system integrity. Administrators should verify their distribution's kernel version and apply the relevant security patches immediately upon release to prevent local exploitation and ensure system stability.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Linux kernel's batman-adv module is vulnerable to an issue involving the incorrect caching of unowned originator pointers in BAT IV.

Executive Summary:
An improper caching vulnerability in the Linux kernel batman-adv module requires immediate attention to prevent potential exploitation of the network stack.

Vulnerability Details

CVE-ID: CVE-2026-46238

Affected Software: Linux kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the BAT IV implementation of the batman-adv module, where unowned originator pointers are incorrectly cached in certain paths. This flaw relates to how the kernel manages neighbor address lookups.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk to network reliability and system security. Exploitation could lead to unauthorized network traffic manipulation or system-level instability, potentially impacting the availability of the affected network infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version provided by your vendor to ensure the fix for the batman-adv module is implemented.

Proactive Monitoring: Review kernel logs for anomalous network behavior or errors related to BAT IV path lookups.

Compensating Controls: Implement strict network segmentation and monitor for unusual traffic patterns within the mesh network environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this kernel update as a priority, especially in environments relying on B.A.T.M.A.N. advanced for mesh networking. Apply the official patches from your distribution maintainer as soon as they become available.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel's PlayStation HID driver allows for out-of-bounds reads due to insufficient clamping of touch report counts.

Executive Summary:
An out-of-bounds memory access vulnerability in the Linux kernel's PlayStation HID driver could lead to system crashes or information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-46232

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in dualshock4_parse_report, which fails to properly clamp the num_touch_reports value. An attacker can provide a malformed device report that triggers an out-of-bounds read of the touch_reports array.

Business Impact

The CVSS score of 8.1 (High) reflects the danger of out-of-bounds memory access. While primarily affecting systems using specific HID hardware, the impact includes potential system instability or the leakage of kernel memory contents, which could be used to bypass security features like KASLR.

Remediation Plan

Immediate Action: Update the Linux kernel to the version containing the fix for the PlayStation HID driver.

Proactive Monitoring: Monitor system logs for driver-related errors or kernel panics related to HID device input.

Compensating Controls: Restrict physical access to USB ports and prevent the connection of unauthorized HID devices on critical systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Although the impact is localized to HID drivers, kernel-level memory corruption is a serious issue. Administrators should ensure kernel updates are applied to all affected Linux distributions.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel's batman-adv module during the deletion of backbone claims.

Executive Summary:
A critical use-after-free vulnerability in the Linux kernel batman-adv module poses a significant risk of system instability or potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-46212

Affected Software: Linux kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a use-after-free memory corruption vulnerability triggered within the batadv_bla_del_backbone_claims() function. The flaw occurs when the module incorrectly handles memory references while dropping link entries from a hash list.

Business Impact

The CVSS score of 8.8 indicates a high severity risk. Successful exploitation could lead to kernel-level memory corruption, resulting in system crashes (Denial of Service) or potential arbitrary code execution, which would compromise the integrity and availability of the affected system.

Remediation Plan

Immediate Action: Apply the latest security updates provided by your Linux distribution maintainer to address the batman-adv module vulnerability.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages specifically associated with the batman-adv module.

Compensating Controls: Restrict access to network configurations that utilize the B.A.T.M.A.N. advanced protocol to trusted administrative users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations running Linux kernels with batman-adv enabled should prioritize patching. Ensure that all kernel updates are tested in a staging environment before deployment to production systems to mitigate the risk of operational disruption.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions up to c6c8fea29769d998d94fcec9b9f14d4b52b349d3; version 2.6.38 is affected.
---END_METADATA---

Description Summary:
An integer overflow in the Linux kernel's batman-adv component can lead to out-of-bounds memory access.

Executive Summary:
A high-severity integer overflow in the Linux kernel's batman-adv module poses a risk of out-of-bounds memory read and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-46198

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions up to c6c8fea29769d998d94fcec9b9f14d4b52b349d3; version 2.6.38 is affected.

Vulnerability: The batadv_iv_ogm_send_to_if function suffers from an integer overflow due to a type mismatch between size checks (int) and the variable buff_pos (s16), allowing out-of-bounds reads.

Business Impact

This vulnerability could be exploited to leak sensitive kernel memory or cause a denial of service. The CVSS score of 8.8 reflects the significant risk to systems utilizing the batman-adv routing protocol.

Remediation Plan

Immediate Action: Upgrade to a kernel version that includes the fix, such as Debian trixie (6.12.90-2), forky (7.0.9-1), sid (7.0.10-1), or upstream commit 0799e5943611006b346b8813c7daf7dd5aa26bfd.

Proactive Monitoring: Monitor network traffic and system logs for unusual behavior related to the batman-adv protocol.

Compensating Controls: Isolate networks running batman-adv to prevent untrusted traffic from interacting with the vulnerable module.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators of mesh networks utilizing batman-adv should prioritize updating their kernel to the versions specified above. This is essential to prevent potential information disclosure and system instability.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A slab-use-after-free vulnerability exists in the Linux kernel's mac80211 subsystem during radar detection work.

Executive Summary:
A high-severity use-after-free flaw in the Linux kernel's mac80211 radar detection logic can lead to system crashes or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-46166

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: The ieee80211_dfs_cac_cancel function can free a channel context while it is still being iterated during radar detection, leading to a use-after-free condition.

Business Impact

Exploitation of this vulnerability could lead to system instability, crashes, or potential code execution. The CVSS score of 8.8 highlights the severity of this memory management flaw in the wireless subsystem.

Remediation Plan

Immediate Action: Apply the kernel patch available via the GitHub advisory (GHSA-pqxf-3wq6-69f8) to ensure safe list iteration.

Proactive Monitoring: Monitor system logs for kernel oops related to the mac80211 subsystem.

Compensating Controls: Disable wireless radar detection features if not required, or restrict the affected system's environment to minimize exposure to DFS-related triggers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Wireless infrastructure administrators must prioritize applying the provided kernel patch to fix this use-after-free vulnerability. Failure to address this could lead to significant system instability and potential security compromises.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's mac80211 fast-RX handling can lead to packet processing errors.

Executive Summary:
A high-severity concurrency issue in the Linux kernel's wireless subsystem can lead to incorrect packet processing and potential denial of service.

Vulnerability Details

CVE-ID: CVE-2026-46152

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: A static variable rx_result in ieee80211_invoke_fast_rx() is accessed concurrently, allowing callers to overwrite each other's results during parallel RX operations.

Business Impact

This flaw can result in the incorrect processing of Wi-Fi packets, potentially leading to unstable network performance or denial of service. With a CVSS score of 8.8, this vulnerability poses a risk to the reliability of wireless communication.

Remediation Plan

Immediate Action: Apply the kernel patch that converts rx_result to an automatic variable, ensuring each invocation maintains its own result.

Proactive Monitoring: Monitor wireless performance metrics and system logs for packet processing errors or driver-related errors.

Compensating Controls: If patching is unavailable, implement network-level monitoring to detect and alert on anomalous packet loss or wireless instability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize kernel updates that resolve this concurrency flaw. Ensuring that packet processing remains isolated between parallel threads is critical for network reliability and performance.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Bluetooth stack vulnerability in the Linux kernel allows for out-of-bounds reads and infinite loops during specific event processing.

Executive Summary:
An out-of-bounds read vulnerability in the Linux kernel Bluetooth subsystem could lead to system crashes or sensitive information exposure.

Vulnerability Details

CVE-ID: CVE-2026-46138

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The flaw resides in hci_le_create_big_complete_evt(), where incorrect iteration logic over bis_handle results in out-of-bounds memory access and a potential infinite loop when processing Bluetooth LE events.

Business Impact

With a CVSS score of 8.1 (High), this vulnerability poses a risk to any system utilizing Bluetooth functionality. Successful exploitation can lead to a denial-of-service (system hang) or potentially expose sensitive memory contents, which is particularly concerning in mobile or IoT deployments.

Remediation Plan

Immediate Action: Apply the latest kernel security patches from your distribution vendor to resolve the Bluetooth event processing logic.

Proactive Monitoring: Disable Bluetooth on servers or critical systems where it is not required to eliminate the attack surface entirely.

Compensating Controls: Monitor system performance for high CPU usage or logs indicating Bluetooth driver issues.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Bluetooth-related vulnerabilities are often overlooked in server environments. Ensure that your kernel is patched and consider disabling unused Bluetooth hardware to reduce the overall attack surface.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel's mac80211 subsystem occurs when MLO connection preparation fails.

Executive Summary:
An improper handling of MLO connection failures in the Linux kernel's mac80211 component can lead to unexpected interface resets.

Vulnerability Details

CVE-ID: CVE-2026-46125

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: When connection preparation fails for Multi-Link Operation (MLO) connections, the wireless interface is incorrectly reset to a non-MLD state, potentially causing network connectivity issues.

Business Impact

This vulnerability can cause Denial of Service (DoS) for wireless network interfaces, impacting connectivity for affected systems. The CVSS score of 8.8 reflects the potential for significant operational disruption in wireless-dependent environments.

Remediation Plan

Immediate Action: Apply the latest security updates for the Linux kernel provided by your distribution vendor.

Proactive Monitoring: Monitor wireless interface logs for frequent resets or unexpected changes in interface configuration.

Compensating Controls: Use wired network connections where possible for mission-critical systems until a patch can be verified and deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Wireless infrastructure administrators should monitor for vendor-provided kernel patches to address this interface reset issue. Promptly applying these updates will prevent potential denial-of-service scenarios in your wireless environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel stable lines including 6.6.140, 6.12.88, 6.18.30, 7.0.7, and the 7.1 release-candidate fix path.
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's KVM x86 shadow paging allows for potential memory corruption.

Executive Summary:
A high-severity KVM x86 shadow paging flaw can result in a use-after-free condition due to stale reverse-map entries.

Vulnerability Details

CVE-ID: CVE-2026-46113

Affected Software: Linux Kernel

Affected Versions: Linux kernel stable lines including 6.6.140, 6.12.88, 6.18.30, 7.0.7, and the 7.1 release-candidate fix path.

Vulnerability: The KVM shadow MMU incorrectly computes Guest Frame Numbers (GFNs) for direct shadow pages, leaving stale reverse-map entries after an unexpected GFN appears, leading to a use-after-free.

Business Impact

This vulnerability could be exploited to compromise the stability of virtualized environments, potentially leading to guest-to-host escapes or system crashes. With a CVSS score of 8.8, this is a critical concern for virtualization infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to the corrected versions (6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc) immediately.

Proactive Monitoring: Monitor virtualized host logs for unexpected KVM errors or memory-related crashes.

Compensating Controls: Restrict access to KVM configuration interfaces and ensure guest isolation policies are strictly enforced.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations running Linux-based virtualization hosts must prioritize these kernel updates. Ensuring the stability and security of the KVM hypervisor is essential for preventing host-level compromises.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A metadata reference count underflow in the Linux kernel's dm-thin driver could lead to memory corruption and potential system compromise.

Executive Summary:
A high-severity reference count underflow in the dm-thin metadata handling could lead to memory corruption and potential system-wide instability.

Vulnerability Details

CVE-ID: CVE-2026-46107

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the dm-thin (Device Mapper Thin Provisioning) driver, specifically within the rebalance_children function. An error in managing metadata reference counts leads to an underflow condition, which can cause the kernel to free memory that is still in use.

Business Impact

The CVSS score of 7.8 reflects the high risk of this vulnerability. Use-after-free and reference count underflows are critical memory corruption issues that can lead to system crashes, unauthorized data access, or arbitrary code execution by a local attacker.

Remediation Plan

Immediate Action: Apply the latest kernel security patches provided by your Linux distribution, specifically those addressing dm-thin metadata management.

Proactive Monitoring: Monitor storage-related kernel logs for any signs of metadata corruption or unexpected dm-thin performance issues.

Compensating Controls: If possible, limit the use of thin-provisioned volumes on untrusted or highly exposed systems until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Storage driver vulnerabilities are extremely dangerous as they can impact data integrity at the block level. Organizations should treat this as a high-priority update, especially on systems heavily reliant on thin provisioning.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper NVMe request size limitation in the Linux kernel's mpt3sas SCSI driver could lead to firmware-related issues or potential buffer overflows.

Executive Summary:
A high-severity flaw in the mpt3sas driver's handling of NVMe request sizes could potentially lead to buffer overflows or system instability when communicating with HBA hardware.

Vulnerability Details

CVE-ID: CVE-2026-46105

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the mpt3sas driver, which failed to adequately limit NVMe request sizes according to the HBA firmware's MDTS (Maximum Data Transfer Size) capabilities. This oversight can lead to requests that exceed the hardware's capacity, causing unpredictable behavior or potential buffer overflows.

Business Impact

A CVSS score of 7.8 highlights the risk posed by this driver flaw. Successful exploitation could lead to system crashes or potentially allow an attacker to corrupt kernel memory via the interaction with the HBA hardware, impacting both data integrity and system availability.

Remediation Plan

Immediate Action: Update to a kernel version that correctly enforces the 2 MiB limit for NVMe requests within the mpt3sas driver.

Proactive Monitoring: Check logs for hardware-related error messages or firmware communication errors during high I/O workloads.

Compensating Controls: Ensure firmware for all HBA devices is up-to-date, as this can sometimes provide additional safeguards against large I/O requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Driver-level vulnerabilities can often be exploited if an attacker has the ability to trigger specific I/O patterns. Organizations using mpt3sas controllers should prioritize patching to ensure that hardware communication remains within safe, validated bounds.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel's AFS filesystem driver involves an incorrect implementation of mmap preparation.

Executive Summary:
A high-severity memory management issue in the AFS filesystem driver could lead to potential security vulnerabilities related to incorrect mmap handling.

Vulnerability Details

CVE-ID: CVE-2026-46100

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue is related to the mmap_prepare() function within the AFS filesystem driver. A previous code change introduced a flaw that necessitated a partial revert of commit 9d5403b1036c, which attempted to convert generic file mmap users but introduced a regression.

Business Impact

The CVSS score of 7.8 indicates a high severity, as improper mmap handling can often lead to memory corruption or security bypasses. This vulnerability could be exploited to cause system instability or potential unauthorized memory access.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel updates which include the revert of the faulty mmap_prepare() change.

Proactive Monitoring: Monitor for any anomalous activity or system panics on servers utilizing the AFS (Andrew File System) network filesystem.

Compensating Controls: If the AFS driver is not required, consider blacklisting the afs module to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should audit their Linux environments for the use of the AFS filesystem and ensure that kernel updates are applied promptly. Addressing regressions in core filesystem drivers is essential for maintaining a secure and stable operating environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel's IPv6 networking stack within seg6 and rpl lwtunnels, potentially leading to denial of service.

Executive Summary:
A critical use-after-free vulnerability in the Linux kernel's IPv6 networking stack poses a significant risk of system instability and denial of service.

Vulnerability Details

CVE-ID: CVE-2026-46099

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a use-after-free vulnerability within the seg6 and rpl lwtunnels of the Linux kernel's IPv6 stack. It can be triggered by a local user under specific race conditions involving PREEMPT_RT configurations and concurrent nexthop route entry releases.

Business Impact

Successful exploitation of this vulnerability can lead to a system crash or denial of service, significantly impacting service availability and operational continuity. With a CVSS score of 8.1, this is classified as a High-severity flaw that requires prompt attention to ensure system stability and reliability.

Remediation Plan

Immediate Action: Apply the latest security updates provided by your Linux distribution maintainer. The fix involves ensuring proper reference counting by calling skb_dst_force() after ip6_route_input() to prevent the use of invalid memory.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected service interruptions, particularly on systems utilizing IPv6 segment routing or RPL tunnels.

Compensating Controls: Restrict access to local system resources to trusted users to mitigate the risk of a local user triggering the race condition required for exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its impact on core kernel memory management, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this kernel-level vulnerability, organizations should prioritize the deployment of kernel security updates across all affected infrastructure. Testing the patch in a staging environment is advised to ensure compatibility before deploying to production systems to prevent potential downtime.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A concurrency issue in the Linux kernel's vmalloc shrinker mechanism can lead to race conditions and potential memory corruption.

Executive Summary:
A high-severity concurrency flaw in the Linux kernel's memory management subsystem could allow local attackers to induce race conditions and potential system failure.

Vulnerability Details

CVE-ID: CVE-2026-46093

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a lack of proper locking in the decay_va_pool_node() function within the vmalloc memory management code. The concurrent invocation from both the __purge_vmap_area_lazy() path and the shrinker via vmap_node_shrink_scan() without the vmap_purge_lock results in a race condition.

Business Impact

With a CVSS score of 7.8, this flaw poses a significant risk to the stability of the virtual memory subsystem. Successful exploitation could result in kernel panics, memory corruption, or potentially elevated privileges for a local attacker.

Remediation Plan

Immediate Action: Upgrade to a kernel version that correctly implements the vmap_purge_lock within the shrinker path.

Proactive Monitoring: Monitor system logs for memory-related kernel errors or unusual performance degradation associated with virtual memory operations.

Compensating Controls: Ensure that systems are running with hardened kernel configurations that limit the ability of user-space processes to trigger intensive memory management operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel memory management bugs are critical due to their potential for widespread system impact. Patching should be treated as a high-priority task for all Linux environments to ensure the integrity of the memory subsystem.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's ALSA loopback driver during format changes can lead to system instability.

Executive Summary:
A high-severity use-after-free vulnerability in the ALSA loopback driver could allow an attacker to trigger kernel-level memory errors and potentially compromise the system.

Vulnerability Details

CVE-ID: CVE-2026-46090

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a use-after-free flaw in the aloop (ALSA loopback) driver, specifically occurring when a peer runtime is accessed during a format-change stop operation. The race condition in loopback_check_format() allows the kernel to access a stale pointer, leading to memory corruption.

Business Impact

The CVSS score of 7.8 reflects the high severity associated with kernel-level memory corruption. An attacker capable of triggering this race condition can cause system crashes, leading to downtime, or potentially achieve arbitrary code execution in the kernel context.

Remediation Plan

Immediate Action: Update the Linux kernel to a version containing the fix for the ALSA aloop UAF issue.

Proactive Monitoring: Monitor for unexpected kernel crashes or instability, particularly on systems utilizing audio loopback functionality.

Compensating Controls: Limit access to audio devices and system configuration if possible, as the exploit requires specific conditions related to audio stream format changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of complex race conditions in kernel drivers. Administrators should prioritize patching to prevent potential memory-based attacks that could lead to full system compromise.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management flaw in the Linux kernel's acomp component allows for an incorrect pointer to be stored in the request base.

Executive Summary:
A high-severity memory vulnerability in the Linux kernel may lead to system instability or potential exploitation.

Vulnerability Details

CVE-ID: CVE-2026-46081

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions.

Vulnerability: The vulnerability exists in the acomp_save_req function, where an incorrect pointer is stored during cryptographic operations. This memory mismanagement can result in undefined behavior or system crashes.

Business Impact

A CVSS score of 7.8 indicates a significant risk. Successful exploitation could lead to local privilege escalation or denial-of-service conditions, impacting the reliability and security of systems running the affected kernel.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your Linux distribution vendor immediately.

Proactive Monitoring: Review system logs for kernel panics or unusual memory-related errors that may indicate exploitation attempts.

Compensating Controls: Implement kernel hardening features and ensure that non-privileged users have restricted access to sensitive system functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators should prioritize patching the Linux kernel across all affected environments. Maintaining an updated kernel is essential for protecting against memory-based vulnerabilities of this nature.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A KVM nested virtualization vulnerability in the Linux kernel may lead to improper exception handling when processing unhandled VMMCALLs.

Executive Summary:
An exception handling flaw in the Linux kernel KVM module could allow a malicious guest to trigger instability in the host environment.

Vulnerability Details

CVE-ID: CVE-2026-46076

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The issue occurs in KVM's nested SVM implementation, where a #UD (Invalid Opcode) exception is not properly synthesized for unhandled VMMCALL instructions, potentially leading to incorrect execution flow within the hypervisor.

Business Impact

A CVSS score of 7.9 (High) highlights the risk to virtualized environments. Exploitation could allow a guest VM to disrupt the host kernel or potentially escape the sandbox, posing a severe threat to multi-tenant cloud environments and virtualized server infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel on the host hypervisor to the latest version to ensure proper exception handling for nested virtualization.

Proactive Monitoring: Monitor host system logs for unexpected hypervisor exceptions or guest-triggered kernel panics.

Compensating Controls: Ensure that untrusted guests are isolated using proper security policies and that hypervisor features are configured with the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

For organizations relying on virtualization, this patch is critical. Prioritize updates to host kernels to prevent potential guest-to-host breakout scenarios.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A lifetime management issue in the Linux kernel's framebuffer deferred I/O (fbdev) subsystem could lead to use-after-free conditions.

Executive Summary:
A high-severity memory management flaw in the Linux kernel's framebuffer subsystem could lead to use-after-free exploitation and system instability.

Vulnerability Details

CVE-ID: CVE-2026-46065

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from improper handling of the fb_info structure lifetime in the deferred I/O subsystem. By failing to properly disconnect deferred I/O from the fb_info lifecycle, the kernel may access freed memory, resulting in a use-after-free vulnerability.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to system stability and security. Exploitation could allow an attacker to trigger kernel panics or potentially gain unauthorized control over kernel execution flow, leading to system-wide compromise or persistent Denial of Service.

Remediation Plan

Immediate Action: Apply the latest kernel security patches provided by your Linux distribution maintainer to ensure the fix for fb_deferred_io_state is implemented.

Proactive Monitoring: Review system audit logs for recurring kernel panic events or memory-related faults specifically involving graphics or framebuffer drivers.

Compensating Controls: If immediate patching is not feasible, restrict local access to the system and limit the ability of non-privileged users to interact with framebuffer devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities involving memory management are highly dangerous and often serve as primitives for further exploitation. Security teams should expedite the deployment of kernel updates to all affected Linux-based infrastructure to neutralize this risk.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An integer overflow vulnerability in the Linux kernel NTFS3 driver's volume boundary check could lead to memory corruption.

Executive Summary:
A high-severity integer overflow vulnerability in the Linux kernel NTFS3 driver could allow a local attacker to trigger memory corruption and potentially escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-46062

Affected Software: Linux kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the run_unpack() function of the NTFS3 driver due to an improper integer overflow check during volume boundary validation. This flaw allows an attacker to bypass boundary checks, potentially resulting in out-of-bounds memory access.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high risk to system integrity and availability. Successful exploitation could lead to system crashes (Denial of Service) or potential arbitrary code execution, resulting in unauthorized access to sensitive kernel-level data and operational disruption.

Remediation Plan

Immediate Action: Update your Linux kernel to the latest version provided by your distribution vendor that includes the fix for this NTFS3 driver flaw.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts associated with file system operations.

Compensating Controls: Restrict access to mounting NTFS volumes to trusted users only, as the vulnerability typically requires the ability to mount or interact with a malicious file system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching their Linux distributions. Ensure that automated patching workflows are active and verify that the kernel updates are applied across all production environments to mitigate the risk of local exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's amphion media driver leads to a kernel panic during m2m job release.

Executive Summary:
A race condition between job abort and device run in the Linux kernel amphion driver can cause a kernel panic due to premature memory deallocation.

Vulnerability Details

CVE-ID: CVE-2026-46058

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a race condition where v4l2_m2m_ctx_release() frees the m2m_ctx structure while v4l2_m2m_try_run() is concurrently attempting to call device_run using the same context. This leads to a kernel panic when the driver attempts to access the freed memory.

Business Impact

This vulnerability can be exploited to cause a denial-of-service (system panic) on devices using the Amphion VPU. With a CVSS score of 7.8, it represents a high-severity risk to system reliability.

Remediation Plan

Immediate Action: Update the kernel to a version that properly synchronizes the job abort and device run paths in the amphion driver.

Proactive Monitoring: Monitor for kernel panics associated with video processing tasks.

Compensating Controls: If possible, restrict access to the video hardware nodes to authorized processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This update is vital for maintaining the stability of systems utilizing Amphion video drivers. Administrators should apply the kernel patches as soon as they are made available by their distribution vendor.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel's Bluetooth subsystem during SSP passkey handling.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel Bluetooth component could lead to system crashes or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-46056

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability occurs because hci_conn lookup and field access are not protected by the hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), allowing the connection to be freed concurrently.

Business Impact

This flaw can result in a kernel crash or potentially be leveraged for further exploitation, such as code execution. The 8.8 CVSS score reflects the high risk posed to systems utilizing Bluetooth functionality.

Remediation Plan

Immediate Action: Update the Linux kernel to a version that includes the fix ensuring hci_conn lookup and field access are covered by the hdev lock.

Proactive Monitoring: Monitor system logs for Bluetooth-related kernel oops or instability.

Compensating Controls: Disable Bluetooth services on servers or systems where it is not strictly required to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency, particularly on systems where Bluetooth is active. Updating the kernel to the patched version is the only effective way to mitigate this use-after-free risk.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper memory cleanup in the Linux kernel's RDS protocol driver during copy errors leads to a potential use-after-free.

Executive Summary:
A memory management error in the Linux kernel RDS driver during copy errors can cause a use-after-free vulnerability, risking system stability.

Vulnerability Details

CVE-ID: CVE-2026-46053

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The __rds_rdma_map() function incorrectly handles MR cleanup when a copy error occurs. Because ownership of sg/pages is handed to the transport after get_mr() succeeds, failing to handle cleanup correctly results in a use-after-free condition.

Business Impact

This flaw can be exploited to cause a system crash or potentially corrupt kernel memory. Given the 7.8 CVSS score, this is a significant risk for systems that utilize the Reliable Datagram Sockets (RDS) protocol.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch to fix the MR cleanup logic in the RDS driver.

Proactive Monitoring: Monitor system logs for RDS-related errors or kernel panics.

Compensating Controls: Disable the RDS protocol if it is not required for your network infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using the RDS protocol should prioritize this security update. Verify kernel versions and apply the patches to mitigate the risk of kernel memory corruption and system instability.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A flaw in the Linux kernel's IPv4 ICMP implementation fails to validate reply types, potentially leading to memory corruption or instability.

Executive Summary:
An input validation vulnerability in the Linux kernel ICMP handling could allow an attacker to trigger kernel-level memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-46037

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability occurs in the IPv4 ICMP stack, where the kernel fails to validate the outbound reply type before accessing icmp_pointers. This can lead to improper pointer usage when handling Extended Echo Replies.

Business Impact

The CVSS score of 8.2 (High) signifies a severe risk to system stability and security. Successful exploitation could lead to kernel panics (Denial of Service) or potential privilege escalation, impacting critical production workloads and server reliability.

Remediation Plan

Immediate Action: Apply the latest kernel security patches provided by your Linux distribution maintainer to ensure the ICMP pointer validation logic is updated.

Proactive Monitoring: Monitor network traffic for malformed ICMP packets and review system logs for signs of kernel instability.

Compensating Controls: Use network-level filtering to block or sanitize anomalous ICMP traffic where possible, although this does not replace the necessity of a kernel update.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of kernel-level flaws, it is imperative to treat this update with high priority. Organizations should test and deploy the latest kernel updates to mitigate the risk of exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's vfio/cdx driver can lead to a use-after-free of the cdx_irqs array during concurrent ioctl calls.

Executive Summary:
A high-severity race condition in the Linux kernel's vfio/cdx driver may lead to system instability or unauthorized memory access.

Vulnerability Details

CVE-ID: CVE-2026-46036

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vfio_cdx_set_msi_trigger() function lacks proper serialization when handling concurrent VFIO_DEVICE_SET_IRQS ioctls. This can lead to a use-after-free vulnerability when the cdx_irqs array is modified simultaneously by multiple threads.

Business Impact

With a CVSS score of 7.8, this flaw poses a significant risk to system stability and integrity. An attacker capable of triggering this race condition could cause a kernel panic or potentially escalate privileges.

Remediation Plan

Immediate Action: Apply the latest Linux kernel security patches that introduce the cdx_irqs_lock mutex.

Proactive Monitoring: Monitor system logs for unexpected behavior in VFIO-related kernel functions or concurrent access errors.

Compensating Controls: Limit access to VFIO device interfaces to privileged users to prevent unauthorized exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel updates should be applied immediately to resolve the serialization flaw. Ensuring that the kernel is patched against such race conditions is vital for maintaining a secure and stable operating environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A missing notification during listener migration in the Linux kernel's TCP stack can lead to stalled connections.

Executive Summary:
A failure to notify waiters during TCP listener migration in the Linux kernel can cause connection handling issues and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-46015

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: When a TCP child socket is migrated from a closing listener to another socket in an SO_REUSEPORT group, the target listener does not receive a notification via sk_data_ready(). This leaves the waiter unaware of the new accept-queue entry.

Business Impact

This issue can result in dropped or stalled network connections, impacting the availability of network services. While not a direct exploit for code execution, the 7.8 CVSS score acknowledges the potential for significant denial-of-service in high-traffic network environments.

Remediation Plan

Immediate Action: Update the Linux kernel to a version that includes the fix for sk_data_ready() notifications during listener migration.

Proactive Monitoring: Monitor network service performance and check for stalled accept-queues or unexpected connection timeouts.

Compensating Controls: Ensure network load balancers are configured to handle potential connection drops gracefully if the kernel cannot be patched immediately.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

For high-availability network services, this update is essential to prevent connection handling errors. Administrators should test and deploy the kernel patch in their network infrastructure to ensure continued stability of TCP services.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's mtk-jpeg media driver occurs due to uncancelled work during the release path.

Executive Summary:
A race condition in the mtk-jpeg driver's release process can trigger a use-after-free vulnerability, leading to system crashes.

Vulnerability Details

CVE-ID: CVE-2026-46011

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The mtk_jpeg_release() function frees the context structure without properly cancelling pending or running work in ctx->jpeg_work. This leaves a dangling pointer, resulting in a use-after-free condition when the work queue attempts to access the already-freed context.

Business Impact

This flaw can be used to cause a denial-of-service (system crash) on devices that utilize the MediaTek JPEG hardware decoder. With a 7.8 CVSS score, it represents a high-severity risk for mobile or embedded devices running affected kernel versions.

Remediation Plan

Immediate Action: Update the kernel to a version that properly cancels pending work in the mtk-jpeg release path.

Proactive Monitoring: Monitor system logs for kernel panics during video processing or JPEG decoding tasks.

Compensating Controls: If applicable, restrict user access to the hardware media decoders.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability should be addressed through standard patch management processes for kernel-based software. Given the risk of system instability, ensure that all affected hardware devices receive the necessary kernel update.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A missing error handling check in the Linux kernel rxrpc implementation can lead to improper state management during token extraction.

Executive Summary:
An error handling flaw in the Linux kernel rxrpc module potentially exposes the system to memory exhaustion or state corruption.

Vulnerability Details

CVE-ID: CVE-2026-46010

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The issue exists in rxgk_extract_token(), where a failure in rxgk_decrypt_skb() (specifically an -ENOMEM return) is not handled correctly. The function fails to terminate execution, leading to continued processing in an invalid state.

Business Impact

The CVSS score of 8.1 (High) indicates a significant threat to system reliability. Improper error handling in the networking stack can be leveraged to induce system crashes or potentially facilitate more complex attacks, leading to downtime for critical network services.

Remediation Plan

Immediate Action: Update to the latest kernel version provided by your distribution, which includes the necessary error handling logic for rxgk_extract_token().

Proactive Monitoring: Monitor system logs for kernel errors related to network subsystem failures or unexpected abort signals.

Compensating Controls: Implement network segmentation to limit the attack surface available to interact with rxrpc services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Patching the kernel is the only effective way to remediate this logic flaw. IT teams should verify vendor security notices and schedule maintenance windows for the necessary kernel updates.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An integer overflow in the Linux kernel's Nouveau DRM driver allows for bypass of buffer bounds checks.

Executive Summary:
An integer overflow in the Linux kernel Nouveau driver's push buffer relocation validation could allow an attacker to bypass security checks and cause memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-46006

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is located in nouveau_gem_pushbuf_reloc_apply(), where a 32-bit integer overflow occurs during the bounds check of relocation offsets. This allows an attacker to bypass the validation logic, potentially leading to out-of-bounds memory access.

Business Impact

Successful exploitation could lead to local privilege escalation or system crashes on machines using NVIDIA GPUs with the Nouveau driver. The 7.8 CVSS score reflects the serious nature of this kernel-level memory corruption flaw.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel update that corrects the overflow validation in the Nouveau DRM driver.

Proactive Monitoring: Monitor for anomalous GPU driver activity or unexpected system restarts.

Compensating Controls: If the Nouveau driver is not required, switch to proprietary NVIDIA drivers or blacklist the Nouveau module.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a clear risk of memory corruption. Administrators should deploy the security update across all affected Linux systems to mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper UDF partition descriptor handling in the Linux kernel leads to a heap out-of-bounds write vulnerability.

Executive Summary:
A heap out-of-bounds write vulnerability in the Linux kernel UDF file system parser could allow an attacker to trigger corruption via a crafted UDF image.

Vulnerability Details

CVE-ID: CVE-2026-45991

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the UDF partition descriptor bookkeeping. Mounting a specially crafted UDF image with repeated descriptors causes the kernel to perform an out-of-bounds write to the part_descs_loc[] array on the heap.

Business Impact

This flaw could lead to arbitrary code execution or a system crash when a victim mounts a malicious UDF file system. Given the 7.8 CVSS score, this is a critical concern for systems that handle untrusted removable media or disk images.

Remediation Plan

Immediate Action: Update the kernel to a version that includes the fix for UDF partition descriptor bookkeeping.

Proactive Monitoring: Monitor for kernel crashes triggered during the mounting of external media or disk images.

Compensating Controls: Disable the automatic mounting of UDF file systems if they are not required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to trigger memory corruption via a crafted file system makes this a high-priority vulnerability. System administrators should ensure that kernel patches are applied and consider restricting the ability to mount external file systems by non-privileged users.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's GFS2 file system occurs during inline data write operations.

Executive Summary:
A premature release of memory in the GFS2 file system write path can lead to a use-after-free vulnerability, risking system stability.

Vulnerability Details

CVE-ID: CVE-2026-45984

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The inline data buffer head (dibh) is released prematurely in gfs2_iomap_begin() via release_metapath(), while the iomap structure still references the buffer. This creates a use-after-free condition when the kernel attempts to access the data.

Business Impact

This vulnerability could result in data corruption or a system crash on servers utilizing the GFS2 cluster file system. With a CVSS score of 7.8, the impact on data integrity and system uptime is significant, particularly in high-availability environments.

Remediation Plan

Immediate Action: Patch the Linux kernel to the version provided by your vendor that addresses the GFS2 inline data write path issue.

Proactive Monitoring: Monitor GFS2-related error logs and file system integrity checks for signs of corruption.

Compensating Controls: If immediate patching is not feasible, restrict the use of GFS2 inline data features if possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on GFS2 should prioritize this update to avoid potential file system instability. Ensure that kernel updates are applied to all nodes in the GFS2 cluster to maintain a secure and stable environment.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free (UAF) vulnerability exists in the Linux kernel's bonding driver during bond teardown, potentially allowing for concurrent access.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel bonding driver could lead to system crashes or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-45970

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions.

Vulnerability: The vulnerability occurs in rlb_arp_recv due to a race condition during bond teardown, where the ALB RX path accesses rx_hashtbl after it has been freed. This results in a use-after-free condition.

Business Impact

With a CVSS score of 7.8, this flaw poses a notable risk to system availability and security. An attacker capable of triggering this race condition could cause a denial-of-service or potentially execute arbitrary code with kernel-level privileges.

Remediation Plan

Immediate Action: Apply the latest kernel patches from your distribution provider to address the UAF in the bonding driver.

Proactive Monitoring: Monitor system performance and logs for unexpected kernel oops or crashes related to network bonding interfaces.

Compensating Controls: Limit the ability of unprivileged users to manipulate network interface configurations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Patching the kernel is the recommended course of action to mitigate this vulnerability. Organizations should test and deploy the latest kernel updates to ensure system stability and protection against potential exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An incorrect cleanup usage of kfree in the Linux kernel's crypto ccp driver results in a memory deallocation crash.

Executive Summary:
A memory management error in the Linux kernel crypto ccp driver can lead to a system crash when invalid deallocation occurs.

Vulnerability Details

CVE-ID: CVE-2026-45959

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from the improper use of the __cleanup(kfree) attribute on a local pointer variable in the crypto ccp driver. This causes the kernel to attempt to free the address of the local variable itself rather than the buffer returned by kmalloc, leading to a crash due to invalid deallocation.

Business Impact

This vulnerability poses a risk of denial-of-service (DoS) as a local attacker could trigger the crash by interacting with the affected crypto driver. With a CVSS score of 7.8, this is considered a high-severity issue that could disrupt operations on systems utilizing specific hardware-accelerated cryptographic functions.

Remediation Plan

Immediate Action: Apply the latest kernel security patches from your OS vendor to resolve the incorrect cleanup attribute usage.

Proactive Monitoring: Review system logs for frequent driver crashes or unexpected reboots associated with cryptographic module initialization.

Compensating Controls: If patching is delayed, disable or blacklist the affected crypto driver if it is not required for system functionality.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of immediate system crash necessitates timely remediation. Organizations should verify their kernel versions against vendor security bulletins and apply the necessary updates to prevent potential service disruption caused by this memory management error.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel's BPF subsystem due to incorrect reference counting within the check_pseudo_btf_id function.

Executive Summary:
A use-after-free vulnerability in the Linux kernel BPF subsystem could allow a local attacker to trigger memory corruption or system instability.

Vulnerability Details

CVE-ID: CVE-2026-45951

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves incorrect reference counting logic in the check_pseudo_btf_id() function, which can lead to a use-after-free condition when the function is invoked with a zero-refcounted BTF object. An authenticated user with sufficient privileges to interact with BPF could potentially exploit this to cause a kernel crash.

Business Impact

Successful exploitation of this flaw could result in a kernel panic, leading to unplanned downtime and service interruption for critical infrastructure. While the CVSS score of 7.8 indicates high severity, the primary risk is system instability and potential local privilege escalation, which threatens the integrity and availability of the affected host.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest stable release provided by your distribution vendor that includes the fix for this BPF refcounting issue.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports that coincide with BPF-related operations.

Compensating Controls: Restrict access to BPF functionality by limiting CAP_BPF and CAP_SYS_ADMIN privileges to trusted users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to system stability. Administrators should prioritize patching their kernels to ensure that the BPF subsystem is protected against this use-after-free condition. Apply the vendor-supplied security updates as soon as they become available in your distribution's repository.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A bitmap inconsistency in the Linux kernel's ext4 filesystem can lead to data integrity issues under heavy workloads.

Executive Summary:
A filesystem bitmap inconsistency in the Linux ext4 driver could lead to data corruption or system instability.

Vulnerability Details

CVE-ID: CVE-2026-45942

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue involves inconsistency reports in the e4b bitmap within the ext4 driver, observed during high-stress operations with mixed huge-page workloads. This suggests improper synchronization or management of filesystem metadata.

Business Impact

Data corruption is a severe risk for any production environment. With a CVSS score of 7.8, this flaw could lead to data loss or system-wide downtime, necessitating urgent attention for systems relying on ext4.

Remediation Plan

Immediate Action: Update the kernel to the latest version to include the fix for ext4 bitmap consistency.

Proactive Monitoring: Monitor filesystem logs for consistency errors and run fsck periodically on critical volumes.

Compensating Controls: Ensure robust backup procedures are in place to recover from potential data corruption caused by filesystem errors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Filesystem stability is paramount. We recommend applying the kernel patch immediately to prevent the risk of data loss or corruption, particularly on high-load servers utilizing the ext4 filesystem.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A slab-out-of-bounds read vulnerability exists in the Linux kernel's NTFS3 driver during index entry deletion.

Executive Summary:
A memory bounds-checking error in the Linux NTFS3 driver could lead to information disclosure or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-45935

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw occurs in the DeleteIndexEntryRoot function within the NTFS3 driver, where the entry size (esize) is not properly validated against the log record length. An attacker providing a malicious NTFS filesystem could trigger this out-of-bounds read.

Business Impact

This vulnerability could be used to leak kernel memory or cause a denial-of-service. With a CVSS score of 7.8, it poses a risk to systems that mount untrusted NTFS-formatted storage media.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version containing the bounds-checking fix for the NTFS3 driver.

Proactive Monitoring: Monitor for kernel logs indicating slab out-of-bounds errors when interacting with external storage.

Compensating Controls: Avoid mounting NTFS filesystems from untrusted or unknown sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

We recommend applying the kernel patch promptly. For systems that do not require NTFS support, consider disabling the NTFS3 driver module to reduce the attack surface.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An incorrect register state propagation in the Linux kernel's BPF verifier can lead to security policy bypasses.

Executive Summary:
A logic error in the Linux kernel BPF verifier could allow an attacker to bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-45933

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue exists in sync_linked_regs(), where the BPF verifier incorrectly copies register IDs. This can lead to the propagation of incorrect bounds information, potentially allowing a malicious BPF program to read or write memory outside of its permitted range.

Business Impact

This vulnerability is highly significant as it targets the BPF subsystem, often used for security monitoring and packet filtering. Successful exploitation could lead to privilege escalation or complete system compromise, justifying the 7.8 CVSS score.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch that corrects the BPF register ID synchronization.

Proactive Monitoring: Review BPF program loading logs and monitor for anomalous kernel behavior or unexpected BPF program crashes.

Compensating Controls: Restrict access to the bpf() system call to highly privileged users (e.g., via unprivileged_bpf_disabled sysctl).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical patch for any system that utilizes BPF features. Given the potential for privilege escalation, administrators must prioritize this update to maintain the integrity of kernel-level security filters.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's ovpn_net_xmit function can lead to system instability or denial-of-service.

Executive Summary:
A use-after-free vulnerability in the Linux kernel's OVPN network driver poses a risk to system availability and stability.

Vulnerability Details

CVE-ID: CVE-2026-45929

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The ovpn_net_xmit function incorrectly handles socket buffers (skb) when they are shared. If skb_share_check frees the original skb, the function continues to use the pointer, leading to a use-after-free condition.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a high risk to system uptime. Exploitation can result in kernel panics or denial-of-service conditions, impacting network-dependent services.

Remediation Plan

Immediate Action: Update the Linux kernel to a version that includes the fix for the ovpn_net_xmit function.

Proactive Monitoring: Monitor system logs for kernel crashes and error messages associated with the OVPN network interface.

Compensating Controls: If patching is delayed, consider disabling the OVPN module if not strictly required for network operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this as a high-priority update. Patching the kernel will prevent potential system crashes and ensure the continued reliability of network communications.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's RDMA/rxe component within the QP timer handler can lead to system instability.

Executive Summary:
A race condition in the Linux RDMA subsystem could lead to unpredictable system behavior or denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-45910

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a race condition occurring within the QP (Queue Pair) timer handlers in the rdma_rxe driver. This can be triggered by specific timing sequences during RDMA operations, potentially causing internal warnings or kernel panics.

Business Impact

This flaw poses a risk to service availability, particularly for high-throughput network environments relying on RDMA. With a CVSS score of 7.8, it is considered high-priority for data centers.

Remediation Plan

Immediate Action: Update the kernel to the latest version to include the fix for the race condition in the RDMA/rxe driver.

Proactive Monitoring: Monitor system logs for warnings related to rxe_task or other RDMA-related kernel warnings.

Compensating Controls: If immediate patching is not possible, avoid using the rdma_rxe software implementation in production environments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

We recommend applying the kernel patch immediately. Race conditions in kernel drivers are often difficult to debug and can lead to non-deterministic system failures; patching is the only reliable mitigation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A code initialization vulnerability in the Linux kernel's Mediatek clock driver could cause runtime errors due to incorrect memory marking.

Executive Summary:
Improper memory marking in the Linux Mediatek clock driver could lead to unpredictable behavior and system instability.

Vulnerability Details

CVE-ID: CVE-2026-45909

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the incorrect use of __initconst for clock gate structures that are required at runtime. This causes the kernel to treat initialization-time data as constant/disposable, leading to potential memory access issues when those structures are accessed later.

Business Impact

This flaw can result in kernel panics or system instability on devices utilizing Mediatek chips. While it has a CVSS score of 7.8, the real-world impact is largely dependent on the specific hardware/SoC implementation.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel update that removes the incorrect __initconst markers.

Proactive Monitoring: Monitor for kernel panics or hardware-related crashes on Mediatek-based devices.

Compensating Controls: There are no direct compensating controls for this internal code error; patching is the only viable remediation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations deploying Linux on Mediatek hardware should prioritize this update to ensure system stability and prevent potential exploitation of the memory access error.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A cache-coherency vulnerability in the Linux kernel's IOMMU VT-d driver allows for potential memory access before proper initialization.

Executive Summary:
Improper cache management in the Linux kernel's IOMMU driver could lead to unauthorized memory access by hardware devices.

Vulnerability Details

CVE-ID: CVE-2026-45862

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw exists in the VT-d driver, where the PASID table is used before the CPU cache is flushed. This creates a window where the IOMMU hardware may read uninitialized or stale memory, potentially leading to security violations.

Business Impact

This vulnerability poses a risk to system integrity by allowing hardware devices to access potentially sensitive data in memory. With a CVSS score of 7.8, it represents a high-severity risk for virtualization hosts and systems leveraging IOMMU features.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch that corrects the order of cache flushing and PASID table usage.

Proactive Monitoring: Monitor for hardware-related memory faults or unexpected system resets on systems using Intel VT-d.

Compensating Controls: Disable IOMMU features if not strictly required, though this may impact performance and security features like device pass-through.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The complexity of this flaw necessitates a validated kernel update. Organizations using hardware-accelerated virtualization should treat this as a high-priority patch to protect against memory-based information leakage.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's GFS2 filesystem occurs when managing quota data objects during shutdown.

Executive Summary:
A use-after-free vulnerability in the Linux GFS2 filesystem could lead to system instability or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-45861

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue stems from the failure to properly remove quota data objects from the LRU list during filesystem shutdown, resulting in a slab-use-after-free in qd_put. This requires local access and specific filesystem operations to trigger.

Business Impact

This vulnerability could be leveraged by a local attacker to cause a kernel panic or potentially escalate privileges. With a CVSS score of 7.8, the risk is elevated for systems utilizing the GFS2 cluster filesystem, necessitating prompt attention.

Remediation Plan

Immediate Action: Update the kernel to a version containing the fix for the GFS2 quota data management issue.

Proactive Monitoring: Monitor for filesystem-related kernel warnings and logs indicating slab corruption or memory management errors.

Compensating Controls: Implement strict file system permissions and limit local access to systems utilizing GFS2 to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Systems running GFS2 should prioritize this patch. Given the nature of memory corruption vulnerabilities, ensuring the kernel is updated is the only effective way to eliminate the risk of exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A double-free vulnerability exists in the Linux kernel's RDMA/rxe component within the rxe_srq_from_init function.

Executive Summary:
A double-free vulnerability in the Linux kernel RDMA subsystem could allow an attacker to trigger memory corruption and system crashes.

Vulnerability Details

CVE-ID: CVE-2026-45852

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the rxe_srq_from_init function due to improper handling of the queue pointer during initialization. This flaw can be triggered by an authenticated user with access to RDMA interfaces, leading to a double-free condition.

Business Impact

The potential for memory corruption in the kernel can lead to system-wide instability, data corruption, or arbitrary code execution. With a CVSS score of 7.8, this flaw poses a high risk to environments utilizing RDMA/RoCE, potentially affecting high-performance computing clusters and data center infrastructure.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor.

Proactive Monitoring: Review system logs for kernel panic events and memory allocation errors related to the RDMA subsystem.

Compensating Controls: If patching is delayed, restrict access to RDMA interfaces to trusted users and disable the rdma_rxe module if it is not required for production operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities involving memory management are critical. We recommend immediate remediation through verified vendor patches to prevent potential local privilege escalation or denial-of-service attacks against your infrastructure.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel SLIP implementation allows for improper memory access by failing to properly bound decode() reads against compressed packet lengths.

Executive Summary:
A memory access vulnerability in the Linux kernel SLIP subsystem poses a high security risk, potentially allowing local attackers to cause system instability or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-45843

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the slhc_uncompress() function, which parses VJ-compressed TCP headers. By failing to correctly bound decode() and pull16() operations against the compressed packet length, the kernel is susceptible to out-of-bounds memory interactions.

Business Impact

With a CVSS score of 8.2 (High), this kernel-level flaw represents a major security concern. Exploitation could result in system-wide service disruption, denial-of-service, or potentially arbitrary code execution at the kernel level, which is a critical threat to data integrity and system availability.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest patched version provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that systems are running with hardened kernel configurations and that untrusted users are restricted from accessing network-level interfaces that utilize SLIP.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities are inherently critical due to the level of privilege involved. Administrators should verify their current kernel version against vendor security bulletins and apply updates as part of standard patch management cycles to minimize risk.

---METADATA---
VENDOR: SUSE
PRODUCT: wicked dhcp client
AFFECTED_VERSIONS: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1
---END_METADATA---

Description Summary:
The wicked DHCP client is vulnerable to the processing of unsanitized strings from DHCP replies, potentially leading to system compromise.

Executive Summary:
The wicked DHCP client is susceptible to an easily exploitable vulnerability involving the processing of unsanitized strings from network replies.

Vulnerability Details

CVE-ID: CVE-2026-44932

Affected Software: wicked dhcp client

Affected Versions: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1

Vulnerability: This vulnerability involves the passing of unsanitized strings from DHCP replies into the wicked dhcp client. Exploitation is considered easy and requires local network access to inject malicious DHCP responses.

Business Impact

With a CVSS score of 8.8, this flaw represents a major security risk for any system utilizing the wicked DHCP client. An attacker on the local network can exploit this to perform actions with the privileges of the DHCP client process. This could lead to full system compromise, particularly if the client runs with elevated permissions during network configuration.

Remediation Plan

Immediate Action: Apply vendor security updates to wicked version 0.6.79-1.1 or higher (or 0.6.79-150700.3.3.1 for specific distributions) immediately.

Proactive Monitoring: Monitor network traffic for anomalous DHCP traffic or unexpected network configuration changes on critical systems.

Compensating Controls: Use network segmentation to limit the exposure of sensitive systems to potentially untrusted DHCP servers and verify the integrity of DHCP responses where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it targets fundamental network configuration processes. Given the ease of exploitation, system administrators should prioritize patching all affected Linux systems to prevent potential network-based attacks and subsequent system compromise.

---METADATA---
VENDOR: pam-usb
PRODUCT: pam_usb
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the pam_usb authentication module for Linux, which facilitates hardware-based authentication via removable media.

Executive Summary:
A security vulnerability in the pam_usb hardware authentication module for Linux poses a significant risk to system access controls.

Vulnerability Details

CVE-ID: CVE-2026-44713

Affected Software: pam-usb pam_usb

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the authentication mechanism within pam_usb, which allows for hardware-based user verification. Authentication requirements remain unclear based on current data, requiring further investigation into whether this affects local or remote login vectors.

Business Impact

The potential for unauthorized system access through compromised authentication flows presents a severe risk to organizational data integrity. With a CVSS score of 8.8, this flaw is categorized as High severity, indicating that successful exploitation could lead to unauthorized administrative or user-level access to sensitive Linux environments.

Remediation Plan

Immediate Action: Monitor official security channels for the release of a patched version of pam_usb and apply updates immediately upon availability.

Proactive Monitoring: Review system authentication logs for anomalous hardware-based login attempts or unauthorized modifications to authentication configurations.

Compensating Controls: Implement multi-factor authentication (MFA) via alternative providers as a fallback mechanism to reduce reliance on single-factor hardware authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of authentication modules, organizations should prioritize evaluating their exposure to this flaw. System administrators are advised to restrict access to physical ports where possible and prepare for an emergency patching cycle once the vendor releases specific guidance.

---METADATA---
VENDOR: pam_usb
PRODUCT: pam_usb
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in the pam_usb hardware authentication module for Linux may allow for the bypass of authentication mechanisms using removable media.

Executive Summary:
The pam_usb hardware authentication module for Linux contains a high-severity vulnerability that could allow attackers to bypass intended authentication controls.

Vulnerability Details

CVE-ID: CVE-2026-44712

Affected Software: pam_usb (Linux Authentication Module)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the pam_usb module, which facilitates hardware-based authentication. While specific technical parameters are currently unavailable, such flaws in authentication modules typically involve logic errors that could allow an attacker to bypass standard login requirements.

Business Impact

As an authentication component, a failure in pam_usb directly threatens the security of all systems relying on this module for access control. A successful exploit could grant an attacker unauthorized access to sensitive Linux systems, leading to full system compromise. The CVSS score of 8.2 underscores the high risk to confidentiality, integrity, and availability of the affected hosts.

Remediation Plan

Immediate Action: Monitor for official patches from your Linux distribution vendor or the pam_usb project and apply them to all affected systems immediately.

Proactive Monitoring: Audit authentication logs for unusual login attempts or multiple successful logins that do not correspond to authorized hardware key usage.

Compensating Controls: Temporarily revert to standard password-based authentication or implement multi-factor authentication (MFA) via other modules until a secure update for pam_usb is installed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication modules are high-value targets for attackers. Security teams should prioritize patching this vulnerability to restore the integrity of their system login processes and prevent unauthorized hardware-based authentication bypasses.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A metadata integrity issue in the Linux kernel's skbuff handling allows unprivileged users to bypass copy-on-write protections.

Executive Summary:
A critical Linux kernel flaw in frag-transfer helpers can lead to unauthorized data modification by failing to propagate shared-frag markers.

Vulnerability Details

CVE-ID: CVE-2026-43503

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: Helpers __pskb_copy_fclone() and skb_shift() fail to propagate the SKBFL_SHARED_FRAG bit, leading the kernel to incorrectly treat shared pages as private.

Business Impact

This vulnerability allows an unprivileged user to potentially write into the page cache of a root-owned read-only file, posing a severe risk to system security and data integrity. The CVSS score of 8.8 underscores the gravity of this privilege-related flaw.

Remediation Plan

Immediate Action: Apply the official kernel patch that propagates the shared-frag marker and folds the frag_skb flag.

Proactive Monitoring: Monitor for unusual modifications to system files or unexpected behavior in memory management processes.

Compensating Controls: Implement strict kernel hardening and system call filtering where possible to limit the impact of potential privilege escalation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass copy-on-write protections represents a major security risk. Organizations must prioritize applying kernel security updates to ensure the integrity of memory management and prevent unauthorized file modification.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's RDS implementation regarding zerocopy send cleanup can lead to memory corruption.

Executive Summary:
A race condition in the Linux kernel RDS subsystem could allow for memory corruption if a zerocopy send fails during message queuing.

Vulnerability Details

CVE-ID: CVE-2026-43502

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves the handling of zerocopy cleanup when a send operation fails before the message is successfully attached to the socket, leading to potential use-after-free or double-free scenarios.

Business Impact

The CVSS score of 7.8 (High) highlights the risk to system availability and integrity. Race conditions are often difficult to debug and can lead to unpredictable kernel state, potentially resulting in system crashes or arbitrary code execution.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version to ensure the proper cleanup sequence is enforced for zerocopy operations.

Proactive Monitoring: Monitor system logs for kernel panics or memory allocation/deallocation errors.

Compensating Controls: Limit access to RDS functionality and ensure that security updates are applied to the kernel as they become available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Race conditions in the networking stack are serious threats to system security. Organizations should prioritize updating to a patched kernel to eliminate this vulnerability.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's rtmutex component during proxy-lock rollback can lead to privilege escalation.

Executive Summary:
A high-severity use-after-free vulnerability in the Linux kernel's real-time mutex subsystem could allow a local attacker to gain elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-43499

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: During a proxy-lock rollback in rt_mutex_start_proxy_lock(), the kernel incorrectly handles task pointers. This results in a use-after-free condition where a reference to a task is used after it has been improperly managed.

Business Impact

The CVSS score of 7.8 underscores the severity of this vulnerability. By exploiting this flaw, a local attacker could potentially achieve privilege escalation, compromising the entire system.

Remediation Plan

Immediate Action: Update the Linux kernel to a patched version that correctly utilizes waiter::task in remove_waiter().

Proactive Monitoring: Monitor for suspicious local processes attempting to interact with futex or real-time mutex operations.

Compensating Controls: Restrict access to local system resources and implement kernel hardening measures to mitigate potential privilege escalation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation, this patch is of high importance. Administrators must ensure that the kernel is updated to a non-vulnerable version as soon as possible.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A flaw in the Linux kernel's IVPU (Intel Versatile Processing Unit) accelerator driver allows for unauthorized re-exporting of imported GEM objects.

Executive Summary:
An access control vulnerability in the Linux kernel IVPU driver could allow for unauthorized memory access via GEM object re-exporting.

Vulnerability Details

CVE-ID: CVE-2026-43498

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is due to a missing restriction in the IVPU accelerator driver, which allows re-exporting of imported GEM buffers. By failing to return -EOPNOTSUPP for imported objects, the driver enables improper handle-to-fd conversions.

Business Impact

With a CVSS score of 7.8 (High), this vulnerability poses a risk to systems utilizing Intel accelerator hardware. Unauthorized access to GEM memory handles could lead to information disclosure or potential escalation of privileges by manipulating shared graphics/compute memory.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version to include the patch that disallows re-exporting of imported GEM objects.

Proactive Monitoring: Monitor system logs for driver-related errors and restrict user access to accelerator device nodes.

Compensating Controls: Apply strict permissions to device nodes associated with the IVPU driver to prevent unauthorized usage by unprivileged users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Intel-based hardware with IVPU support should prioritize this kernel update to prevent potential memory access violations.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A slab-out-of-bounds read vulnerability exists in the Linux kernel's t7xx WWAN driver when handling modem messages.

Executive Summary:
A high-severity memory corruption flaw in the Linux kernel's t7xx driver could allow a malicious modem to trigger a system crash.

Vulnerability Details

CVE-ID: CVE-2026-43495

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: The t7xx_port_enum_msg_handler function fails to validate the port_count field against the actual message length, leading to a slab-out-of-bounds read of up to 262,140 bytes.

Business Impact

The vulnerability can be exploited by a malicious modem to cause a kernel panic, resulting in a Denial of Service (DoS) for the affected system. With a CVSS score of 8.8, the stability of systems utilizing this kernel component is at significant risk.

Remediation Plan

Immediate Action: Apply the relevant kernel patches (commits 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744, 2b56d7903ab804481f5233a259d5f341e9fd513c, 9855e063e063158cc5bded576382599dc3133202, dd4f4c93c1488d7100b9964f2da4c8b3c29652f1, f94450ce5053b36002995b72d1fa1db3bb08c5bf).

Proactive Monitoring: Monitor system logs for kernel oops or unexpected crash reports related to the t7xx driver.

Compensating Controls: If patching is delayed, ensure hardware security for connected modems to prevent the introduction of malicious messages.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators should update their Linux kernel to a version containing the provided fixes. Given the potential for system instability, prioritizing this update is recommended to prevent denial-of-service conditions.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A memory management flaw in the Linux kernel's RDS (Reliable Datagram Sockets) implementation can lead to inconsistent state when zerocopy page pinning fails.

Executive Summary:
A resource management error in the Linux kernel's RDS subsystem could allow for memory corruption or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-43494

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in rds_message_zcopy_from_user(), where the op_nents variable is not correctly reset when iov_iter_get_pages2() fails. This creates an inconsistent state during cleanup.

Business Impact

The CVSS score of 7.8 (High) indicates a significant threat to system stability. Improper handling of page pinning failures during socket operations can lead to kernel memory leaks or crashes, impacting the availability of network-intensive applications.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version to ensure correct cleanup of RDS zerocopy operations.

Proactive Monitoring: Monitor system logs for kernel warnings related to socket memory or RDS-specific errors.

Compensating Controls: Limit access to RDS-based network sockets where possible and employ general kernel hardening measures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel stability is paramount for high-performance networking. Organizations using RDS should apply the latest kernel updates to remediate this memory management flaw.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (ksmbd)
AFFECTED_VERSIONS: Debian bookworm (6.1.159-1, 6.1.170-3), trixie (6.12.73-1, 6.12.86-1), and forky (7.0.4-1).
---END_METADATA---

Description Summary:
A buffer access vulnerability in the Linux kernel ksmbd module allows out-of-bounds operations due to improper validation of inherited ACE SID lengths during DACL processing.

Executive Summary:
A high-severity memory safety vulnerability in the Linux kernel ksmbd module could lead to denial of service or unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-43490

Affected Software: Linux Kernel (ksmbd)

Affected Versions: Debian bookworm (6.1.159-1, 6.1.170-3), trixie (6.12.73-1, 6.12.86-1), and forky (7.0.4-1). Fixed in Debian sid 7.0.7-1.

Vulnerability: This is a buffer access vulnerability (CWE-805) within the smb_inherit_dacl() function, where a malformed inheritable ACE can trigger out-of-bounds read or write operations. The vulnerability is triggered during the processing of directory DACLs and does not explicitly require user authentication to the kernel, though it is typically reachable via network-based SMB interaction.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a significant risk of system instability or memory corruption. Successful exploitation could allow an attacker to crash the system (Denial of Service) or potentially leak sensitive kernel memory, compromising the confidentiality and integrity of the host server.

Remediation Plan

Immediate Action: Update the Linux kernel to the patched version (7.1-rc3 or the respective distribution-specific fix such as Debian sid 7.0.7-1) as soon as possible.

Proactive Monitoring: Monitor system logs for kernel-related crashes or unexpected memory access errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to SMB services to trusted network segments to reduce the attack surface until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for kernel-level memory corruption, immediate patching is critical for all systems running the ksmbd kernel module. Organizations should prioritize applying vendor-supplied kernel updates to prevent potential service disruption and information leakage.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A permission check vulnerability in the Linux kernel's nsfs allows privileged services to potentially access or leak information from other namespaces.

Executive Summary:
A critical permission check flaw in the Linux kernel's namespace subsystem may allow unauthorized information disclosure between privileged services.

Vulnerability Details

CVE-ID: CVE-2026-43391

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the namespace filesystem (nsfs) where permission checks for handle opening were insufficient. This allows privileged processes to access or view namespaces belonging to other privileged services, violating the intended isolation boundary.

Business Impact

This flaw carries a CVSS score of 8.8, reflecting its potential to bypass critical security isolation. In containerized environments or multi-tenant systems, this could lead to cross-container information leakage, potentially exposing sensitive credentials or proprietary data between isolated services.

Remediation Plan

Immediate Action: Apply the latest kernel security patches released by the Linux distribution vendor to enforce stricter namespace isolation.

Proactive Monitoring: Audit container and process isolation logs for unauthorized attempts to access namespace handles.

Compensating Controls: Use strict SELinux or AppArmor profiles to limit the capabilities of privileged processes, even those that might be subject to namespace-based isolation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Ensuring robust namespace isolation is essential for modern server and cloud infrastructure security. Administrators should update kernel versions immediately to restore mandatory access controls and prevent potential cross-service data leakage.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory handling flaw in the Linux kernel's xfrm/esp implementation allows for insecure in-place decryption, potentially leading to data corruption or information disclosure.

Executive Summary:
A critical memory management vulnerability in the Linux kernel's xfrm/esp subsystem could lead to system instability or security bypasses.

Vulnerability Details

CVE-ID: CVE-2026-43284

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue involves incorrect handling of shared skb fragments during decryption in the xfrm/esp subsystem. Because MSG_SPLICE_PAGES can attach pipe pages directly to an skb, performing in-place decryption on shared memory is unsafe and can be exploited.

Business Impact

With a CVSS score of 8.8, this kernel vulnerability is highly critical. It could allow for the exposure of encrypted network traffic or result in kernel panics, causing significant service disruptions for systems utilizing IPsec tunnels or similar network encryption protocols.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest patched version provided by your distribution vendor.

Proactive Monitoring: Review system logs for kernel panics or anomalies in network decryption performance.

Compensating Controls: Where possible, isolate highly sensitive network traffic to hardware-accelerated encryption modules that are not subject to this specific kernel path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities require immediate attention due to their potential for full system compromise. Administrators must prioritize applying kernel security updates across all affected server and workstation environments as soon as they become available.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (wl1251 driver)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Linux kernel's wl1251 Wi-Fi driver exists due to missing bounds validation on firmware-supplied packet IDs.

Executive Summary:
A critical buffer overflow in the Linux kernel wl1251 Wi-Fi driver could allow attackers to trigger memory corruption via malicious firmware communication.

Vulnerability Details

CVE-ID: CVE-2026-43113

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a buffer overflow vulnerability in the wl1251_tx_packet_cb() function. The driver uses a completion ID provided by the firmware as an index for the wl->tx_frames[] array without verifying if the ID exceeds the array's bounds.

Business Impact

An attacker capable of influencing the firmware or intercepting the firmware-host communication could trigger this memory corruption, leading to system crashes or arbitrary code execution. Given the CVSS score of 8.8, this represents a significant threat to systems using the affected hardware, particularly in embedded or IoT environments.

Remediation Plan

Immediate Action: Apply vendor security updates as they become available. If no patch is currently available for your specific distribution, consider disabling the wl1251 driver if not strictly required.

Proactive Monitoring: Monitor system logs for driver-level errors or unexpected crashes related to Wi-Fi transmission completions.

Compensating Controls: Implement network-level security to prevent untrusted devices from interacting with the host's wireless firmware management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of trusting firmware-supplied indices in kernel drivers. Organizations should prioritize updating kernel packages and, where possible, restrict wireless device access to mitigate the risk of malicious firmware-based exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (CIFS client)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the Linux kernel's CIFS client allows a system crash when processing empty or malformed path strings.

Executive Summary:
A vulnerability in the Linux kernel CIFS client can be triggered by specifically crafted file paths, leading to a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2026-43112

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an out-of-bounds read vulnerability occurring within the cifs_sanitize_prepath function. It is triggered when the function receives an empty string or a string containing only delimiters, which can cause the kernel to access memory outside of the intended buffer.

Business Impact

The primary impact of this vulnerability is a denial-of-service, as the out-of-bounds read will likely result in a kernel panic and subsequent system crash. With a CVSS score of 8.8, this poses a substantial risk to file server stability and availability for any system utilizing the CIFS/SMB client.

Remediation Plan

Immediate Action: Apply available kernel updates provided by your distribution. Note that for some distributions, a vendor-supplied patch may not yet be available; monitor vendor security trackers closely.

Proactive Monitoring: Monitor kernel logs for recurring crashes associated with CIFS mount operations or unusual file system activity.

Compensating Controls: If patching is delayed, restrict the use of untrusted or externally sourced SMB shares that may provide malicious path strings to the client.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should audit their infrastructure for systems utilizing CIFS mounts. While this is primarily a denial-of-service vulnerability, the risk to system availability is high, and patching should be performed as soon as a stable update is released by the distribution vendor.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (brcmfmac driver)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Linux kernel's brcmfmac Wi-Fi driver allows out-of-bounds memory access via malformed IF events from the firmware.

Executive Summary:
A critical out-of-bounds memory access vulnerability in the Linux kernel's brcmfmac driver could lead to system instability or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-43110

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an improper input validation vulnerability where the brcmf_fweh_handle_if_event() function fails to perform range checks on the bsscfgidx field before using it as an array index. The vulnerability is triggered when the host processes a crafted IF event from the Wi-Fi firmware, placing the attack surface at the firmware-host boundary.

Business Impact

Successful exploitation of this vulnerability could lead to a denial-of-service (system crash) or potentially allow a local attacker to escalate privileges by manipulating kernel memory. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of Linux-based systems relying on Broadcom Wi-Fi hardware.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution (e.g., SUSE or Red Hat). Fixed versions include kernel-source >= 6.4.0-150700.53.55.1 for supported SUSE distributions.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected Wi-Fi driver resets that may indicate attempts to trigger an out-of-bounds access.

Compensating Controls: Ensure that systems are running with kernel hardening features enabled, such as Address Space Layout Randomization (ASLR) and stack canaries, to mitigate potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical nature of the kernel-level impact, administrators should prioritize patching their Linux kernels. Organizations relying on Broadcom Wi-Fi chipsets must verify their kernel version against the provided security updates to ensure the bsscfgidx range check is properly implemented.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: Prior to 3.3.8
---END_METADATA---

Description Summary:
A command injection vulnerability exists in electerm prior to version 3.3.8, where remote version strings are unsafely passed to system commands.

Executive Summary:
A critical command injection vulnerability in electerm allows attackers to execute arbitrary system commands by manipulating remote version data.

Vulnerability Details

CVE-ID: CVE-2026-41501

Affected Software: electerm

Affected Versions: Prior to 3.3.8

Vulnerability: The runLinux() function in install.js improperly concatenates attacker-controlled remote version strings into a system rm -rf command. This lack of input validation allows for arbitrary command injection on the host system.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for remote code execution with the privileges of the application. This could lead to a complete system compromise, including the deletion of files, installation of malware, or exfiltration of sensitive configuration data stored within the terminal client environment.

Remediation Plan

Immediate Action: Upgrade the electerm application to version 3.3.8 or later to resolve the unsafe command execution logic.

Proactive Monitoring: Monitor system logs for unauthorized file deletion attempts or unexpected child processes initiated by the electerm application.

Compensating Controls: Restrict the permissions of the user account running the terminal client to the minimum necessary level to contain the potential impact of an exploit.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for full system compromise via command injection, organizations should prioritize updating electerm to version 3.3.8. Immediate remediation is necessary to prevent attackers from leveraging this vulnerability to gain control over local systems.