https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:00:00 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-68140 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-68140 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/euvd-2026-356011 EUVD-2026-356011 https://cve.radiocsirt.org/vuln/euvd-2026-356011 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68140 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68140 https://cve.radiocsirt.org/vuln/ghsa-8p4m-4f3f-9xqp <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> https://cve.radiocsirt.org/vuln/ghsa-8p4m-4f3f-9xqp https://cve.radiocsirt.org/vuln/msrc_cve-2026-68140 msrc_CVE-2026-68140 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68140 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68140 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68140 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730