https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T00:57:41.981846+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-03770 bdu:2024-03770 2026-10-16T00:57:42.070691+00:00 bdu:2024-03770 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0334 certfr-2024-avi-0334 — De multiples vulnérabilités ont été découvertes dans <span class="textit">le noyau Linux de Debian</span>. Elles permet… 2026-10-16T00:57:42.070729+00:00 certfr-2024-avi-0334 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26639 fkie_cve-2024-26639 2026-10-16T00:57:42.070749+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/ghsa-q99v-mcmh-7x5m GHSA-q99v-mcmh-7x5m 2026-10-16T00:57:42.070777+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm, kmsan: fix infinite recursion due to RCU critical section

Alexander Potapenko writes in [1]: "For every memory access in the code instrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata for the memory being accessed. For virtual memory the metadata pointers are stored in the corresponding `struct page`, therefore we need to call virt_to_page() to get them.

According to the comment in arch/x86/include/asm/page.h, virt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is true, so KMSAN needs to call virt_addr_valid() as well.

To avoid recursion, kmsan_get_metadata() must not call instrumented code, therefore ./arch/x86/include/asm/kmsan.h forks parts of arch/x86/mm/physaddr.c to check whether a virtual address is valid or not.

But the introduction of rcu_read_lock() to pfn_valid() added instrumented RCU API calls to virt_to_page_or_null(), which is called by kmsan_get_metadata(), so there is an infinite recursion now. I do not think it is correct to stop that recursion by doing kmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that would prevent instrumented functions called from within the runtime from tracking the shadow values, which might introduce false positives."

Fix the issue by switching pfn_valid() to the _sched() variant of rcu_read_lock/unlock(), which does not require calling into RCU. Given the critical section in pfn_valid() is ver…

 https://cve.radiocsirt.org/vuln/gsd-2024-26639 gsd-2024-26639 2026-10-16T00:57:42.070818+00:00 gsd-2024-26639 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26639 UBUNTU-CVE-2024-26639 2026-10-16T00:57:42.070831+00:00

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 54 more

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0654 WID-SEC-W-2024-0654 — Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifische Angriffe 2026-10-16T00:57:42.070915+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.