https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T23:38:53.810865+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46303 CVE-2026-46303 — isofs: validate Rock Ridge CE continuation extent against volume size 2026-10-17T23:38:54.227096+00:00

Affected: Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved:

isofs: validate Rock Ridge CE continuation extent against volume size

rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.

With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size.

Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the exis…

 https://cve.radiocsirt.org/vuln/usn-8566-1 USN-8566-1 — linux, linux-gcp, linux-gke, linux-realtime vulnerabilities 2026-10-17T23:38:54.227296+00:00

Affected: Ubuntu:26.04:LTS: linux, Ubuntu:26.04:LTS: linux-gcp, Ubuntu:26.04:LTS: linux-gke, Ubuntu:26.04:LTS: linux-realtime

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PSP security protocol; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - Intel NPU Driver; - DRBD Distributed Replicated Block Device drivers; - Ublk userspace block driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - EDAC drivers; - EFI core; - FWCTL subsystem; - GPU drivers; - HID subsystem; - I3C subsystem; - InfiniBand drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - NVIDIA Tegra memory controller driver; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - MediaTek network drivers; - NVME drivers; - PCI subsystem;…