Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 5 June 2026

Last updated 30 June 2026

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

Last updated 26 August 2025

NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of service.

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.

NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.

NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.

It was discovered that aufs improperly managed inode reference counts in the vfsubdentryopen() method. A local attacker could use this vulnerability to cause a denial of service attack.

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock() and a BUG() in fs/ext4/ext4.h:2057, It is tested on 4.14 and 5.16, it randomly got segmentation faults in either systemd or other libc functions after the bug is triggered twice or more with below traces.

================================================================== [ 99.129641] BUG: KASAN: use-after-free in dxinsertblock+0xf9/0x1e0 [ 99.129678] Read of size 199528 at addr ffff88825d339028 by task tmp32/1078

[ 99.129729] CPU: 3 PID: 1078 Comm: tmp32 Not tainted 5.4.171 #1 [ 99.129730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 99.129731] Call Trace: [ 99.129734] dumpstack+0x8b/0xb9 [ 99.129736] ? dxinsertblock+0xf9/0x1e0 [ 99.129739] printaddressdescription.constprop.4+0x23/0x400 [ 99.129740] ? dxinsertblock+0xf9/0x1e0 [ 99.129742] kasanreport+0x15c/0x1e0 [ 99.129743] ? dxinsertblock+0xf9/0x1e0 [ 99.129744] kasanreport+0x10/0x20 [ 99.129746] checkmemoryregion+0x149/0x1a0 [ 99.129747] memmove+0x1f/0x50 [ 99.129748] dxinsertblock+0xf9/0x1e0 [ 99.129750] dosplit+0x105b/0x1bf0 [ 99.129754] ? ext4renamedirfinish+0x820/0x820 [ 99.129755] ext4dxaddentry+0x30b/0x2a20 [ 99.129757] ? condresched+0x15/0x30 [ 99.129759] ? getblkgfp+0x35/0x7f0 [ 99.129760] ? adddirenttobuf+0x630/0x630 [ 99.129761] ? memset+0x1f/0x40 [ 99.129763] ? fscryptsetupfilename+0x32/0xce0 [ 99.129765] ? ext4getblk+0x127/0x3d0 [ 99.129766] ? dosyscall64+0x9a/0x390 [ 99.129768] ? entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129769] ? ext4iomapbegin+0xf10/0xf10 [ 99.129771] ? addtransactioncredits+0x13d/0xaf0 [ 99.129772] ? memset+0x1f/0x40 [ 99.129773] ? ext4fnamesetupfilename+0xd1/0x1f0 [ 99.129775] ? memset+0x1f/0x40 [ 99.129776] ext4addentry+0x6c7/0xcd0 [ 99.129778] ? makeindexeddir+0x1130/0x1130 [ 99.129779] ? jbd2journalgetwriteaccess+0xaf/0x120 [ 99.129781] ? ext4journalgetwriteaccess+0x41/0x70 [ 99.129782] ? jbd2journalstart+0x2d6/0x760 [ 99.129784] ext4rename+0xef9/0x1e00 [ 99.129786] ? avchaspermnoaudit+0x1b3/0x380 [ 99.129787] ? ext4tmpfile+0x3a0/0x3a0 [ 99.129788] ? avchasextendedperms+0xe80/0xe80 [ 99.129790] ? selinuxpathnotify+0x460/0x460 [ 99.129792] vfsrename+0x84f/0x1550 [ 99.129794] ? tomoyocredprepare+0xb1/0x160 [ 99.129795] ? vfsmkdir+0x5a0/0x5a0 [ 99.129796] ? dalloc+0x56/0x210 [ 99.129797] ? dorenameat2+0x78a/0x970 [ 99.129798] dorenameat2+0x78a/0x970 [ 99.129800] ? userpathcreate+0x30/0x30 [ 99.129801] ? lockrefputreturn+0xd7/0x190 [ 99.129803] ? blkpreruntimesuspend+0x280/0x280 [ 99.129804] ? kmemcachealloc+0x177/0x220 [ 99.129805] ? mntgetcount+0x1e0/0x1e0 [ 99.129806] ? dput+0x5a/0x760 [ 99.129808] ? pathsetxattr+0xb9/0x130 [ 99.129809] ? setxattr+0x240/0x240 [ 99.129810] ? fgetlight+0x55/0x1f0 [ 99.129811] ? fgetlight+0x55/0x1f0 [ 99.129813] x64sysrename+0x5a/0x80 [ 99.129814] dosyscall64+0x9a/0x390 [ 99.129815] ? prepareexittousermode+0xec/0x1a0 [ 99.129817] entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129819] RIP: 0033:0x7f8665863639

Last updated 25 August 2025

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

An information disclosure via path traversal was discovered in apport/hookutils.py function readfile(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Function checkattachmentforerrors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.

The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.

Last updated 14 August 2026

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

An issue was discovered in domadvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORINGOPMADVISE implementation, aka CID-bc0c4d1e176e.

A flaw was found in containerd. Credentials may be leaked during an image pull.

Fixed bug (PHP parses encoded cookie names so malicious Host- cookies can be sent). (CVE-2020-7070)

Fixed bug (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)

A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escapemode parameter to escape fields as an XSS protection mechanism. To mitigate, jsondumper.rb in gon now does escaping for XSS by default without relying on MultiJson.

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.