In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksumstart before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack, skbchecksumhelp can corrupt the network header and cause a bunch of mischief.

This was discovered and reported by Paulos, and has been reporoduced by others independently since.

We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ah6: validate routing header segmentsleft

AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr() assumes that segmentsleft is not larger than the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segmentsleft value. With segmentsleft equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

nsenter --join-cgroup (sys-utils/nsenter.c) opens the target cgroup v2 cgroup.procs while still running as root, writes nsenter's own PID to join that cgroup, and then leaves the descriptor open across later namespace/credential transitions and execve(). The FD is neither closed nor marked OCLOEXEC. Linux performs later cgroup migration checks using the credentials captured in file->fcred at open time, so a program executed inside an attacker-controlled target inherits root's cgroup-migration authority even after dropping to an unprivileged UID with no capabilities. A privileged operator must invoke the documented --join-cgroup operation against the attacker-controlled target (nsenter is not SUID on typical distros). After the FD is inherited, an unprivileged process can migrate an unrelated host root PID into an attacker-owned systemd user-service cgroup and terminate it via cgroup.kill. This is not an autonomous LPE. Introduced by b40650b71a74 (2023-06-28); first released in util-linux v2.40. Affects v2.40 through v2.42.2 and current master (confirmed on Debian 13 util-linux 2.41-5). No upstream fix as of 2026-08-24. Reported upstream by 4drez. GHSA-55fx-f4gg-cfhj.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

In the Linux kernel, the following vulnerability has been resolved:

vhost: reset the vring metadata cache on vring reconfiguration

vq->metaiotlb[] caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok() returns early on a cache hit, taking the hit as proof that the region has already been validated:

if (vhostvqmetafetch(vq, addr, len, type)) return true;

The cache is reset on VHOSTIOTLBUPDATE and VHOSTIOTLBINVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOSTSETVRINGADDR replaces vq->desc, vq->avail and vq->used, nor when VHOSTSETVRINGNUM changes the region sizes.

With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vqaccessok() and vqlogusedaccessok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vqmetaprefetch() hits the stale entry and returns true -- and vhostvqmetafetch() keeps translating through the old mapping as

map->addr + addr - map->start

for an address the mapping no longer covers. vhostcopytouser() and vhostcopyfromuser() consume the result with copytouser() and copyfromuser(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps.

Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlbaccessok()'s slow path.

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress(), when a route is suppressed and released via ip6rtputflags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup() returns the stale (freed) rt6info to its caller. The subsequent dstrelease() then operates on freed memory, hitting rcurefputslowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Summary The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds Only extract trusted archives.

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: stop fast-leave after deleting a port group

brmulticastleavegroup() iterates mp->ports with pp = &p->next in its fast-leave path. After brmulticastdelpg() removes p, continuing the loop advances pp through the deleted entry.

If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, brportgroupequal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group.

Fast leave only needs to remove one matching port group. Break after brmulticastdelpg() so the loop stops before dereferencing the removed entry.

In the Linux kernel, the following vulnerability has been resolved:

sctp: prevent peer transport count overflow

sctpassocaddpeer() increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero.

SCTP sockdiag uses transportcount to reserve the INETDIAGPEERS payload, then copies one sockaddrstorage for every entry in transportaddrlist. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail.

Reject a new unique peer when transportcount has reached U16MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix authhmacs array size in struct sctpcookie

The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers.

However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctpparamhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the authhmacs buffer in the cookie.

As a result, sctpassociationinit() copies beyond the end of authhmacs when initializing the association, corrupting the adjacent authchunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctpauthgethmac().

Fix the array size calculation by including the full SCTP parameter header size.

In the Linux kernel, the following vulnerability has been resolved:

pppoe: reload header pointer after devhardheader()

pppoesendmsg() saves a pointer to the PPPoE header before calling devhardheader(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it.

This can happen when a send is blocked in copyfromuser() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after device header creation. pskbexpandhead() updates that offset when it relocates the head.

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.configpath pod annotation and loads the referenced host TOML file without restriction. As a result, a pod user who can place a file at a host-visible path can supply a configuration that selects an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host. This issue is fixed in version 4.0.0.

In the Linux kernel, the following vulnerability has been resolved:

sctp: don't free the ASCONF's own transport in DEL-IP processing

sctpprocessasconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctprcv()). For an ASCONF located through its Address Parameter by sctprcvasconflookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address.

sctpprocessasconfparam() rejects a DEL-IP for the packet source address (ADDIP D8, SCTPERRORDELSRCIP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order:

[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]

where L differs from the source. The DEL-IP for L passes the D8 check and calls sctpassocrmpeer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctpassocsetprimary() and sctpassocdelnonprimarypeers(): setprimary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primarypath / activepath, and delnonprimarypeers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transportcount of 0 and primarypath/activepath pointing at freed memory.

Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

Chromium: CVE-2026-85046 Type confusion in V8

In the Linux kernel, the following vulnerability has been resolved:

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)