Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 30 June 2026

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Last updated 26 August 2025

NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of service.

Last updated 24 July 2024

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.

NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.

NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.

Canonical cloud-init could allow a local authenticated attacker to obtain sensitive information, caused by the storage of sensitive data in the log files. By gaining access to the log files, an attacker could exploit this vulnerability to obtain hashed passwords information, and use this information to launch further attacks against the affected system.

It was discovered that aufs improperly managed inode reference counts in the vfsubdentryopen() method. A local attacker could use this vulnerability to cause a denial of service attack.

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock() and a BUG() in fs/ext4/ext4.h:2057, It is tested on 4.14 and 5.16, it randomly got segmentation faults in either systemd or other libc functions after the bug is triggered twice or more with below traces.

================================================================== [ 99.129641] BUG: KASAN: use-after-free in dxinsertblock+0xf9/0x1e0 [ 99.129678] Read of size 199528 at addr ffff88825d339028 by task tmp32/1078

[ 99.129729] CPU: 3 PID: 1078 Comm: tmp32 Not tainted 5.4.171 #1 [ 99.129730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 99.129731] Call Trace: [ 99.129734] dumpstack+0x8b/0xb9 [ 99.129736] ? dxinsertblock+0xf9/0x1e0 [ 99.129739] printaddressdescription.constprop.4+0x23/0x400 [ 99.129740] ? dxinsertblock+0xf9/0x1e0 [ 99.129742] kasanreport+0x15c/0x1e0 [ 99.129743] ? dxinsertblock+0xf9/0x1e0 [ 99.129744] kasanreport+0x10/0x20 [ 99.129746] checkmemoryregion+0x149/0x1a0 [ 99.129747] memmove+0x1f/0x50 [ 99.129748] dxinsertblock+0xf9/0x1e0 [ 99.129750] dosplit+0x105b/0x1bf0 [ 99.129754] ? ext4renamedirfinish+0x820/0x820 [ 99.129755] ext4dxaddentry+0x30b/0x2a20 [ 99.129757] ? condresched+0x15/0x30 [ 99.129759] ? getblkgfp+0x35/0x7f0 [ 99.129760] ? adddirenttobuf+0x630/0x630 [ 99.129761] ? memset+0x1f/0x40 [ 99.129763] ? fscryptsetupfilename+0x32/0xce0 [ 99.129765] ? ext4getblk+0x127/0x3d0 [ 99.129766] ? dosyscall64+0x9a/0x390 [ 99.129768] ? entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129769] ? ext4iomapbegin+0xf10/0xf10 [ 99.129771] ? addtransactioncredits+0x13d/0xaf0 [ 99.129772] ? memset+0x1f/0x40 [ 99.129773] ? ext4fnamesetupfilename+0xd1/0x1f0 [ 99.129775] ? memset+0x1f/0x40 [ 99.129776] ext4addentry+0x6c7/0xcd0 [ 99.129778] ? makeindexeddir+0x1130/0x1130 [ 99.129779] ? jbd2journalgetwriteaccess+0xaf/0x120 [ 99.129781] ? ext4journalgetwriteaccess+0x41/0x70 [ 99.129782] ? jbd2journalstart+0x2d6/0x760 [ 99.129784] ext4rename+0xef9/0x1e00 [ 99.129786] ? avchaspermnoaudit+0x1b3/0x380 [ 99.129787] ? ext4tmpfile+0x3a0/0x3a0 [ 99.129788] ? avchasextendedperms+0xe80/0xe80 [ 99.129790] ? selinuxpathnotify+0x460/0x460 [ 99.129792] vfsrename+0x84f/0x1550 [ 99.129794] ? tomoyocredprepare+0xb1/0x160 [ 99.129795] ? vfsmkdir+0x5a0/0x5a0 [ 99.129796] ? dalloc+0x56/0x210 [ 99.129797] ? dorenameat2+0x78a/0x970 [ 99.129798] dorenameat2+0x78a/0x970 [ 99.129800] ? userpathcreate+0x30/0x30 [ 99.129801] ? lockrefputreturn+0xd7/0x190 [ 99.129803] ? blkpreruntimesuspend+0x280/0x280 [ 99.129804] ? kmemcachealloc+0x177/0x220 [ 99.129805] ? mntgetcount+0x1e0/0x1e0 [ 99.129806] ? dput+0x5a/0x760 [ 99.129808] ? pathsetxattr+0xb9/0x130 [ 99.129809] ? setxattr+0x240/0x240 [ 99.129810] ? fgetlight+0x55/0x1f0 [ 99.129811] ? fgetlight+0x55/0x1f0 [ 99.129813] x64sysrename+0x5a/0x80 [ 99.129814] dosyscall64+0x9a/0x390 [ 99.129815] ? prepareexittousermode+0xec/0x1a0 [ 99.129817] entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129819] RIP: 0033:0x7f8665863639

Last updated 25 August 2025

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

An information disclosure via path traversal was discovered in apport/hookutils.py function readfile(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Function checkattachmentforerrors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.

The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.

A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can use the eBPF verifier to abuse a spectre like flaw where they can infer all system memory.

Last updated 12 October 2026

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

An issue was discovered in domadvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORINGOPMADVISE implementation, aka CID-bc0c4d1e176e.

A flaw was found in containerd. Credentials may be leaked during an image pull.