https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T20:24:00.839354+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/CERTFR-2025-AVI-0307 CERTFR-2025-AVI-0307 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un at… 2026-10-02T20:24:03.530939+00:00 CERTFR-2025-AVI-0307 https://vulnerability.circl.lu/vuln/bdu:2025-06351 bdu:2025-06351 2026-10-02T20:24:03.531078+00:00 bdu:2025-06351 https://vulnerability.circl.lu/vuln/bell-cve-2023-53015 BELL-CVE-2023-53015 2026-10-02T20:24:03.531140+00:00

Affected: Alpaquita:stream: linux-lts

 https://vulnerability.circl.lu/vuln/fkie_cve-2023-53015 fkie_cve-2023-53015 2026-10-02T20:24:03.531179+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: betop: check shape of output reports

betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play().

 https://vulnerability.circl.lu/vuln/ghsa-r3gg-v2qj-wcmp GHSA-r3gg-v2qj-wcmp 2026-10-02T20:24:03.531223+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: betop: check shape of output reports

betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play().

 https://vulnerability.circl.lu/vuln/oesa-2025-1408 OESA-2025-1408 — kernel security update 2026-10-02T20:24:03.531250+00:00

Affected: openEuler:20.03-LTS-SP4: kernel

The Linux Kernel, the operating system core itself. Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: add flush_workqueue to prevent uaf

Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue).

The race can be demonstrated below:

Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2]

In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF.

This UAF is easy to trigger, crash trace by POC is like below

[ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4…

 https://vulnerability.circl.lu/vuln/rhsa-2023:6583 RHSA-2023:6583 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update 2026-10-02T20:24:03.531476+00:00

kernel: seg6: fix the iif in the IPv6 socket control block Kernel: race when faulting a device private page in memory manager kernel: use-after-free in l1oip timer handlers kernel: Rate limit overflow messages in r8152 in intr_callback kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: perf: Fix perf_pending_task() UaF kernel: gpiolib: fix memory leak in gpiochip_setup_dev() kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: dax: make sure inodes are flushed before destroy cache kernel: watch_queue: Actually free the watch kernel: watch_queue: Fix NULL dereference in error cleanup kernel: rtc: pl031: fix rtc features null pointer dereference kernel: tpm: fix reference counting for struct tpm_chip kernel: NFSv4: Don't hold the layoutget locks across multiple RPC calls kernel: xprtrdma: treat all calls not a bcall when bc_serv is NULL kernel: net: ipv6: unexport __init-annotated seg6_hmac_init() kernel: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). kernel: regulator: scmi: Fix refcount leak in scmi_regulator_probe kernel: mm/mempolicy: fix uninit-v…

 https://vulnerability.circl.lu/vuln/rhsa-2024:0412 RHSA-2024:0412 — Red Hat Security Advisory: kernel security and bug fix update 2026-10-02T20:24:03.533109+00:00

kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: data races around sk->sk_prot kernel: USB-accessible buffer overflow in brcmfmac kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Report vmalloc UAF in dvb-core/dmxdev kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: HID: check empty report_list in hid_validate_values() kernel: hid: Use After Free in asus_remove() kernel: use-after-free in smb2_is_status_io_timeout() kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: denial of service in tipc_conn_close kernel: Possible use-after-free since the two fdget() during vhost_net_set_backe…

 https://vulnerability.circl.lu/vuln/suse-su-2025:1176-1 SUSE-SU-2025:1176-1 — Security update for the Linux Kernel 2026-10-02T20:24:03.533290+00:00

Security update for the Linux Kernel

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2023-53015 UBUNTU-CVE-2023-53015 2026-10-02T20:24:03.533960+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws and 147 more

In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play().

 https://vulnerability.circl.lu/vuln/wid-sec-w-2025-0649 WID-SEC-W-2025-0649 — Linux Kernel: Mehrere Schwachstellen 2026-10-02T20:24:03.534316+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht spezifizierte Effekte zu erzielen.