A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmapnetlblimport' routine. While processing the CIPSO restricted bitmap tag in the 'cipsov4parsetagrbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization).

It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire).

As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.

A flaw was found in the Linux kernel with files on tmpfs and hugetlbfs. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behaviour.

At this time there is an understanding there is no crash or priviledge escalation but the impact of modifications on these filesystems of files in production systems may have adverse affects.

A suggested upstream patch:

https://lore.kernel.org/lkml/20181126173452.26955-1-aarcange@redhat.com/T/#u

An upstream patchset:

9e368259ad988356c4c95150fafd1a06af095d98 userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails 5b51072e97d587186c2f5390c8c9c1fb7e179505 userfaultfd: shmem: allocate anonymous memory for MAPPRIVATE shmem 29ec90660d68bbdd69507c1c8b4e33aa299278b1 userfaultfd: shmem/hugetlbfs: only allow to register VMMAYWRITE vmas e2a50c1f64145a04959df2442305d57307e5395a userfaultfd: shmem: add isize checks dcf7fe9d89763a28e0f43975b422ff141fe79e43 userfaultfd: shmem: UFFDIOCOPY: set the page dirty if VMWRITE is not set

It was discovered that the implementation of the BasicAttributes class in the JDNI component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

It was discovered that the implementation of the Path2D and CSS classes in the AWT component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

It was discovered that the implementation of the ArrayBlockingQueue class in the Libraries component of OpenJDK did not check that all assumed invariants were satisfied after creating object instance from a serialized form, leaving the instance in an inconsistent state. If a Java application deserialized a specially-crafted input, this could cause it to raise an unexpected exceptions or allocate an excessive amount of memory.

A use-after-free flaw was found in the way the AWT component of OpenJDK performed loading of the GTK library. An untrusted Java application or applet could use this flaw to possibly bypass certain Java sandbox restrictions.

Last updated 25 August 2025

It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application using JGSS to use previously freed context.

It was discovered that the DHKeyAgreement and P11KeyAgreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break encryption by attacking key agreement rather than the encryption using the negotiated key.

The patch for this issue causes classes' method generateSecret(String algorithm) to fail unless it's call for "TlsPremasterSecret", or the "jdk.crypto.KeyAgreement.legacyKDF" system property is set to true.

It was discovered that the DerValue class in the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER (Distinguished Encoding Rules) encoded input. It could allocate a large amount of memory even when processing short input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker-supplied DER encoded input.

In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.