Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

ASP.NET Core Elevation of Privilege Vulnerability

In the Linux kernel, the following vulnerability has been resolved:

media: video-i2c: use vb2videounregisterdevice on driver removal

The driver uses vb2foprelease() as its file release operation, so vb2videounregisterdevice() should be used instead of videounregisterdevice() during driver removal.

This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

In the Linux kernel, the following vulnerability has been resolved:

net: thunderx: fix PTP device ref leak in nicvfprobe()

caviumptpget() acquires a reference to the PTP PCI device through pcigetdevice(). If any initialization step fails after caviumptpget(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures.

dpaa2-switch: fix the error path in dpaa2switchrx()

btrfs: protect sbwritepointer() with invalidate lock

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: let stripe batch bmseq comparison wrap-safe

Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way.

In the Linux kernel, the following vulnerability has been resolved:

xen/gntalloc: validate grant count before allocation

gntallocioctlalloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc().

Use a subtraction-based check while holding grefmutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock and not a spinlock.

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwlmvmscanfits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe() after the fits check.

Also advertise maxschedscanielen using iwlmvmmaxscanielen() so userspace limits account for driver-inserted DS/TPC bytes.

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: remove stale rcubarrier() in brmulticastdevdel()

This rcubarrier() came from a time callrcu() calls were used in net/bridge/brmulticast.c.

Now kfreercu() is there, we can remove this problematic rcubarrier() which causes extreme RTNL pressure in many syzbot reports.

INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 taskflags:0x4208060 flags:0x00080000 lastsleep:612797637337 Workqueue: netns cleanupnet Call Trace: <TASK> [<ffffffff81914eaa>] contextswitch+0xf2a/0x1730 kernel/sched/core.c:6483 [<ffffffff81201143>] schedule+0x1133/0x43a0 kernel/sched/core.c:8411 [<ffffffff8120446b>] scheduleloop kernel/sched/core.c:8514 [inline] [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529 [<ffffffff8121a093>] scheduletimeout+0xc3/0x2b0 kernel/time/sleeptimeout.c:75 [<ffffffff81205347>] dowaitforcommon kernel/sched/completion.c:100 [inline] [<ffffffff81205347>] waitforcommon kernel/sched/completion.c:121 [inline] [<ffffffff81205347>] waitforcommon kernel/sched/completion.c:132 [inline] [<ffffffff81205347>] waitforcompletion+0x2c7/0x5d0 kernel/sched/completion.c:153 [<ffffffff81b8f27f>] rcubarrier+0x49f/0x620 kernel/rcu/tree.c:3888 [<ffffffff860091b3>] brmulticastdevdel+0x303/0x350 net/bridge/brmulticast.c:4459 [<ffffffff85fb5dbc>] brdevuninit+0x1c/0x40 net/bridge/brdevice.c:157 [<ffffffff8568058c>] unregisternetdevicemanynotify+0x1c1c/0x2300 net/core/dev.c:12599 [<ffffffff8562be43>] opsexitrtnllist net/core/netnamespace.c:187 [inline] [<ffffffff8562be43>] opsundolist+0x3d3/0x940 net/core/netnamespace.c:248

Azure AI Foundry Elevation of Privilege Vulnerability

Microsoft Exchange Online Remote Code Execution Vulnerability

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service APIKEY setting. With APIKEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCPSERVERMODE=read-only setting does not prevent anonymous access to read/search tools, including search, getobjectinfo, batchgetinfo, extensioninfo, securityinfo, findreferences, and findeventhandlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

Chromium CVE-2026-113175: Improper input validation

Chromium CVE-2026-113339: Use after free

Chromium CVE-2026-113280: Memory corruption

Chromium CVE-2026-113271: Use after free

Chromium CVE-2026-113279: Memory corruption

A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txmmoduleobjectdeallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.

The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

Chromium CVE-2026-112993: Use after free