CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A race condition was found in the Linux kernel's MCTP USB driver between URB completion and cancellation of the rx_retry work. This can cause a URB to be submitted after the network interface has been stopped.
A vulnerability was found in the Linux kernel's 6LoWPAN stack for IEEE 802.15.4 networks. The lowpan_xmit() function accepts non-IPv6 packets (e.g., ETH_P_AOE), leading to the use of uninitialized data in the lowpan_addr_info structure. An attacker could exploit this for potential information disclosure or system instability.
In the Linux kernel's mac80211 subsystem, a vulnerability was found where the antenna index from the radiotap header is used directly as a shift count in a bit operation. This can cause undefined behavior reported by UBSAN.
In the Linux kernel MPTCP subsystem, a TOCTOU (time-of-check time-of-use) race condition was found while computing the receive window (rcv_wnd). The MPTCP output path reads the acknowledgment sequence (ack_seq) without locking, which may cause inconsistencies between the data_ack value in the DSS option and the calculated receive window in the same packet.
In the Linux kernel, a vulnerability in the mt76 driver for mt7996 chipsets was found where the WCID pointer is not cleared when removing a station link in mt7996_mac_sta_deinit_link(), potentially leading to a use-after-free condition.
In the Linux kernel, two LSM hooks (task_to_inode and inet_conn_established) have been removed from the list of hooks usable by sleepable BPF programs. The bpf_lsm_task_to_inode() hook is called under rcu_read_lock(), and bpf_lsm_inet_conn_established() is called from softirq context, making them unsafe for sleepable programs.
In the Linux kernel, a vulnerability in the BPF subsystem was found where the return value of visit_tailcall_insn() is not checked. This could lead to undefined behavior.
In the Linux kernel drm/gpusvm driver, an unbalanced unlock of the notifier lock was found in drm_gpusvm_scan_mm(). The first jump to the err_free label occurs before calling drm_gpusvm_notifier_lock(), causing an attempt to release a lock that was not acquired.
In the Linux kernel, a vulnerability in the RDMA/core subsystem was found related to NLA_STRING attributes that do not check for a null terminator. This can lead to incorrect string comparison and potential security issues.
A vulnerability was found in the Linux kernel's netfilter nf_tables subsystem, related to incorrect hook deletion during device removal. The previous approach moving hooks from the base list to the transaction list caused read issues on the RCU-protected list in the netlink dump path. The patch restores the NFT_HOOK_REMOVE flag and introduces a new transaction object to track hook deletions without altering the hook_list during the preparation phase.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v2.0 hardware. The encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
In the Linux kernel, the drm/amdgpu driver for VCN v2.5 lacked the no_user_fence flag for encoder and decoder rings. This caused CS submissions with user fences to be rejected, as these rings do not support 64-bit user fence writes.
In the Linux kernel, a vulnerability in the amdgpu driver for VCN v3.0 encoder and decoder rings was found where 64-bit user fence writes are not supported, causing CS submissions with user fences to be rejected. This can lead to malfunction or potential exploitation.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v4.0. The encoder and decoder rings do not support 64-bit user fence writes, which may cause CS submissions with user fences to be rejected.
In the Linux kernel, in the AMDGPU graphics driver for VCN v4.0.3, a vulnerability was found where the VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v4.0.5 hardware. The VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
In the Linux kernel, the amdgpu driver for VCN v5.0.0 did not set the no_user_fence flag for encoder rings. This caused CS submissions with user fences to be accepted even though the hardware does not support 64-bit user fence writes.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v5.0.1 hardware. The VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
In the Linux kernel, a vulnerability was found in the AMDGPU graphics driver for JPEG v2.0 rings. The lack of support for 64-bit user fence writes on JPEG rings causes CS submissions with user fences to be rejected.
In the Linux kernel, the amdgpu driver for JPEG v2.5 rings lacks support for 64-bit user fence writes, causing CS submissions with user fences to be rejected.