This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Only systems with SMB Direct enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Only systems with SMB Direct enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-98797.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-98797.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-98130.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-98130.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-99284.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-99284.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 6.3.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 6.3.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-50073.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-50073.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-64138.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-64138.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Xen Security Advisory CVE-2026-99287 / XSA-532

Linux xen-netback: guest can trigger double unmap of memory

ISSUE DESCRIPTION =================

When xen-netback is setting up the connection to a frontend, it is mapping the ring pages and then validating the ring pages' contents. In case the ring index values are illegal, xen-netback tries to unmap all allocated resources of the connection. Due to a missing test for already unmapped memory, the unmap can happen twice, resulting in a potential unmap of another guest's memory page.

IMPACT ======

The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host.

Information leaks or privilege escalations cannot be ruled out.

VULNERABLE SYSTEMS ==================

Linux versions 5.5 and newer are vulnerable.

MITIGATION ==========

Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem.

Using a dedicated network driver domain per guest will mitigate the problem.

CREDITS =======

This issue was discovered by Tu Dinh of Vates.

RESOLUTION ==========

Applying the attached patch resolves this issue.

xsa532-linux.patch Linux

$ sha256sum xsa532 4d835bd07ca645ee9b9dadfffd1224bdfaa28d609c6af3666b38df54486bc9f6 xsa532-linux.patch $

NOTE REGARDING LACK OF EMBARGO ==============================

The issue is affecting the same driver as XSA-531, which has no embargo, too. -----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrzZgcMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZwDEH/AyWeZ/6Ej8kaE1nqKU740uF2dPKn9zrcazgcNlW gkisqJn+RQm2b3SRoYrnxWMLQOTvWpPQTbKrJmVUk4ehPUr8OJrpyTwihX5iA7zs q995XWsDraOAGL6vw3msrPJBqERB2JFmJG2XcqxlqFpSdhAXpb7nSM2YBm3EhjQp xJnZ6t8dBEaB+lOsP5sD3KtXUIlui7crrwkuwFQmosWkGfbAIHoyvYVLqWedA8yy Dm+9Wtze82oPy9dvn8qLF2Q9xsehkOw3o9A6lROWJk73ExlA0xHLwhuns8Q/86y/ bRKjybJ7wZXX3Rjtzupjs6/68nzGNyN/1aAmwCFOo+eP9UQ= =O99r -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Xen Security Advisory CVE-2026-99286 / XSA-531

Linux xen-netback: guest can trigger use-after-free for network statistics reads

ISSUE DESCRIPTION =================

The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), there was missing RCU synchronization before freeing the memory holding the statistic data. This was meant to be fixed by the patch of XSA-526, but that patch failed to set the indication that the data should no longer be accessed, before waiting for RCU to have finished accesses. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible.

IMPACT ======

The most likely outcome is a driver crash, possibly escalated to a host crash. This then is a Denial of Service (DoS) affecting the entire host.

Information leaks cannot be ruled out.

VULNERABLE SYSTEMS ==================

Linux versions 4.11 and newer are vulnerable. Note that the patch for XSA-526 is still needed.

MITIGATION ==========

Using a userspace PV network backend (e.g. the qemu based "qnic" backend) will mitigate the problem.

Using a dedicated network driver domain per guest will mitigate the problem.

CREDITS =======

This issue was discovered by Tu Dinh of Vates.

RESOLUTION ==========

Applying the attached patch resolves this issue.

xsa531-linux.patch Linux

$ sha256sum xsa531 1da1dc0543ad3b61698e6d9afc90720bb54f314b6fbc58ab83b8ee0b86fda086 xsa531-linux.patch $

NOTE REGARDING LACK OF EMBARGO ==============================

The issue is directly related to the recent XSA-526 fix and easy to find. -----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrzZgUMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZLHgH/i0+e6pRQkH5mI9w/GPnPDy/QGSVjEaLqj72Oo/9 NOi1fEwHibm7JPOO/NpZHDcGvh2Y5PT7DRlVw1+1EV2+lbLzbxHX2BWVySQx9cPk jBKem0k1udcCsKGxe09/wPW53NPmfw3KARs9L1KEJZl5/akXTUX3ZjSIOyoRg9oE nCmbgcfg2m+KfFGnrieQaiiMOO2iD2KZmeJFLsGaT007wVkeFx2vJBxEdTayiMvF A6BwRTc8gBd3iLxgBMO7Wdz5h3uWlgjDYq8E52tzMFbII3OeYCiiyStYlYFMk3la sVr8bYFcctn1xm4/XukqoS00EVcNVYqaQl1yxkDf8im9qZs= =KIyG -----END PGP SIGNATURE-----

In the Linux kernel, the following vulnerability has been resolved:

inet: reject unhashed sockets during established lookups

TCP established ehash lookups are lockless. The socket caches involved use SLABTYPESAFEBYRCU, so memory can be reused before an RCU reader that retained its old address has finished.

After a tuple match, inetlookupestablished() and inet6lookupestablished() acquire a reference and repeat the tuple check. They do not check whether the new object is hashed. If the address is reused for a socket with the same tuple, the lookup can acquire a reference to the new object and return it while its nulls node is unhashed.

A PoC that drives reuse with a SYN cookie request socket reproduced the crash. The new request socket is unhashed and has a NULL rsklistener. A lookup that had loaded the address of the old request socket acquired the reference published by tcpgetcookiesock() and returned the new object. tcpv4rcv() then read skstate through the NULL listener.

The resulting crash was:

BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy) ... RIP: 0010:tcpv4rcv+0x44e/0x1280 ... R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000 ... CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0 ... Call Trace: <IRQ> ? rawlocaldeliver+0xae/0x240 ipprotocoldeliverrcu+0x2d/0x180 iplocaldeliverfinish+0x84/0x100 ipsublistrcvfinish+0x5f/0x70 ipsublistrcv+0x12a/0x1d0 iplistrcv+0xfd/0x130 netifreceiveskblistcore+0x223/0x250 netifreceiveskblistinternal+0x1d2/0x2c0 ? tryfillrecv+0x39/0x7b0 napicompletedone+0x74/0x170 virtnetpoll+0x445/0x600 napipoll+0x27/0x1e0 netrxaction+0x2fe/0x3b0 handlesoftirqs+0xc2/0x2c0 irqexitrcu+0x74/0xd0 commoninterrupt+0x7f/0x90 </IRQ> ... Kernel panic - not syncing: Fatal exception in interrupt

After taking a reference, check whether the nulls node is unhashed in both IPv4 and IPv6 established lookups. If it is unhashed or the tuple no longer matches, drop the reference and restart the lookup.

Lookups racing with the TIMEWAIT hashdance, or with a request being replaced by its child, now restart and find the new socket instead of returning the old one.

Request sockets that were never inserted into ehash can have a nonzero refcount, and a stale lookup can hold a transient reference. Therefore, when SYN cookie, Fast Open, and request migration paths fail after setting a nonzero refcount, release the references held by those paths with reqskput() instead of freeing the request directly.

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Zero out sring pointers on unmap

If xenvifmapfrontenddatarings() fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings() which keeps the ring pointers unchanged. xenvifconnectdata()'s cleanup path calls xenvifdisconnectqueue() which in turn calls xenvifunmapfrontenddatarings() again, which will attempt to unmap the pointers a second time.

Zero out the ring pointers after they are unmapped to avoid this issue.

This is XSA-532

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Fix XenBus connection failure cleanup

xenvifgetstats and xenvifgetethtoolstats capture vif->numqueues under rcureadlock. We need to unpublish vif->numqueues before synchronizenet to ensure that readers that come afterwards will not read a non-zero vif->numqueues and attempt to access invalid queues.

This is the same cleanup algorithm as used in backenddisconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect").

This is XSA-531

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftbyteorder: remove multi-register support

64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8:

for (i = ... src64 = nftregload64(&src[i]); ~~~~~ u32 src nftregstore64(&dst64[i],

Remove the multi-register support, it has other issues as well:

Pablo points out that commit caf3ef7468f7 ("netfilter: nftables: prevent OOB access in nftbyteordereval") alters semantics: before the loop operated on registers, i.e. for ( ... ) dst32[i] = htons((u16)src32[i])

.. but after the patch it will operate on bytes, which makes this useless to convert e.g. concatenations, which store each compound in its own register.

Multi-convert of u32 has one theoretical application:

ct mark . meta mark . tcp dport @intervalset

Because ct mark and meta mark are host byte order, use with intervals has to convert the byteorder for ct/meta mark value to network byte order (bigendian).

nftables emits this: [ meta load mark => reg 1 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ ct load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] ...

I.e. two separate calls. Theoretically it could be changed to do: [ meta load mark => reg 1 ] [ ct load mark => reg 9 ] [ byteorder reg 1 = htonl(reg 1, 4, 8) ] ...

But then all it would take to change the set to meta mark . tcp dport . ct mark

... and we'd be back to two "byteorder" calls. IOW, support to convert a range of registers is both dysfunctional and dubious.

Simplify this: remove the feature.

Pablo Neira Ayuso points out that nftables before 1.1.0 can generate incorrect byteorder conversions, see 9fe58952c45a, "evaluate: skip byteorder conversion for selector smaller than 2 bytes" in nftables.git). Affected rulesets fail to load with this change and old userspace due to 'len != size' check.

.NET Elevation of Privilege Vulnerability

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

.NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505

CVSS Details

- Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-407

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone validation delivery

Package | Affected version | Patched version --- | --- | --- Microsoft.Extensions.Validation | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118749

Acknowledgements

- Alejandro Pacheco - Artur Stetsko

Revisions

V1.0 (November 10, 2026): Advisory published.