https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:55:20.272932+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12461 bdu:2026-12461 2026-10-04T04:55:20.377697+00:00 bdu:2026-12461 https://cve.radiocsirt.org/vuln/bell-cve-2026-23320 BELL-CVE-2026-23320 2026-10-04T04:55:20.377758+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23320 fkie_cve-2026-23320 2026-10-04T04:55:20.377791+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/ghsa-8459-cmh7-px33 GHSA-8459-cmh7-px33 2026-10-04T04:55:20.377816+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: align net_device lifecycle with bind/unbind

Currently, the net_device is allocated in ncm_alloc_inst() and freed in ncm_free_inst(). This ties the network interface's lifetime to the configuration instance rather than the USB connection (bind/unbind).

This decoupling causes issues when the USB gadget is disconnected where the underlying gadget device is removed. The net_device can outlive its parent, leading to dangling sysfs links and NULL pointer dereferences when accessing the freed gadget device.

Problem 1: NULL pointer dereference on disconnect Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: __pi_strlen+0x14/0x150 rtnl_fill_ifinfo+0x6b4/0x708 rtmsg_ifinfo_build_skb+0xd8/0x13c rtmsg_ifinfo+0x50/0xa0 __dev_notify_flags+0x4c/0x1f0 dev_change_flags+0x54/0x70 do_setlink+0x390/0xebc rtnl_newlink+0x7d0/0xac8 rtnetlink_rcv_msg+0x27c/0x410 netlink_rcv_skb+0x134/0x150 rtnetlink_rcv+0x18/0x28 netlink_unicast+0x254/0x3f0 netlink_sendmsg+0x2e0/0x3d4

Problem 2: Dangling sysfs symlinks console:/ # ls -l /sys/class/net/ncm0 lrwxrwxrwx ... /sys/class/net/ncm0 -> /sys/devices/platform/.../gadget.0/net/ncm0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0 ls: .../gadget.0/net/ncm0: No such file or directory

Move the net_device allocation to ncm_bind() and deallocation to ncm_unbind(). This…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-23320 msrc_CVE-2026-23320 — usb: gadget: f_ncm: align net_device lifecycle with bind/unbind 2026-10-04T04:55:20.377857+00:00 msrc_CVE-2026-23320 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23320 UBUNTU-CVE-2026-23320 2026-10-04T04:55:20.377876+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge and 89 more

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0861 WID-SEC-W-2026-0861 — Linux Kernel: Mehrere Schwachstellen 2026-10-04T04:55:20.378017+00:00

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, weitere nicht spezifizierte Auswirkungen zu verursachen und potentiell Code auszuführen.