Skip to content

Commit 89bffd8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent df824b4 commit 89bffd8

323 files changed

Lines changed: 13727 additions & 52 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/08/GHSA-p44h-f9j6-g9ff/GHSA-p44h-f9j6-g9ff.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p44h-f9j6-g9ff",
4-
"modified": "2026-08-18T00:30:32Z",
4+
"modified": "2026-09-16T12:30:29Z",
55
"published": "2026-08-10T03:31:01Z",
66
"aliases": [
77
"CVE-2026-19389"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://access.redhat.com/errata/RHSA-2026:55865"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2026:67883"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://access.redhat.com/security/cve/CVE-2026-19389"

‎advisories/unreviewed/2026/09/GHSA-22qm-w4f2-g533/GHSA-22qm-w4f2-g533.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22qm-w4f2-g533",
4+
"modified": "2026-09-16T12:30:45Z",
5+
"published": "2026-09-16T12:30:45Z",
6+
"aliases": [
7+
"CVE-2026-90009"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Fix TOCTOU in io_uring passthrough command setup\n\nscsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE.\nUserspace can change a field after we check it and before we use it.\nrequest_len is the sharp case: it can grow past sizeof(scmd->cmnd) after\nthe bound check and overflow scmd->cmnd in copy_from_user().\n\nREAD_ONCE() the SQE fields we check or use into locals before use.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90009"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/4b3c5965fca99f62d31c963294bd5b23cc488e97"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/f033530105aa73d82c121d54b57f358e4865d2f4"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-09-16T11:17:13Z"
32+
}
33+
}

‎advisories/unreviewed/2026/09/GHSA-25fw-r826-pmc4/GHSA-25fw-r826-pmc4.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25fw-r826-pmc4",
4+
"modified": "2026-09-16T12:30:43Z",
5+
"published": "2026-09-16T12:30:43Z",
6+
"aliases": [
7+
"CVE-2026-89961"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population\n\nvmemmap_populate_compound_pages() uses addr_pfn to determine the PFN\noffset within a compound page and to decide whether the current vmemmap\nslot should be populated as a head page mapping or should reuse a tail\npage mapping.\n\nHowever, addr_pfn is advanced manually in parallel with addr. The loop\nitself progresses in vmemmap address space, so each PAGE_SIZE step in addr\ncovers PAGE_SIZE / sizeof(struct page) struct page slots. Since addr_pfn\nis compared against nr_pages in data-PFN units, it should advance by the\nsame number of PFNs. The existing manual increments do not match that and\ntherefore do not reliably track the PFN corresponding to the current addr.\n\nAs a result, pfn_offset can be computed from the wrong PFN and the code\ncan make the head/tail decision for the wrong compound-page position.\n\nFix this by deriving addr_pfn directly from the current vmemmap address\ninstead of carrying it as loop state.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89961"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/7968852a7ca3ce81477ec5b4494a28d612f35a97"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/89a4ae32764172468dea303eb6ae90fe6c859712"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/9c914b7a0bd18834505c65f22225ce22c152b2d9"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/b96be860673f9fbbf12cdadb0b25fc4d6d4d207f"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/e163c7184acf36ac20a248498f4a16016057ca01"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [],
40+
"severity": null,
41+
"github_reviewed": false,
42+
"github_reviewed_at": null,
43+
"nvd_published_at": "2026-09-16T11:17:06Z"
44+
}
45+
}

‎advisories/unreviewed/2026/09/GHSA-27g5-xw56-jcm2/GHSA-27g5-xw56-jcm2.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27g5-xw56-jcm2",
4+
"modified": "2026-09-16T12:30:46Z",
5+
"published": "2026-09-16T12:30:46Z",
6+
"aliases": [
7+
"CVE-2026-92357"
8+
],
9+
"details": "A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92357"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/a2ui-project/a2ui/issues/2299"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/a2ui-project/a2ui/pull/2355"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/a2ui-project/a2ui"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/cve/CVE-2026-92357"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/submit/934118"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/405444"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/vuln/405444/cti"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-200"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-09-16T11:17:25Z"
67+
}
68+
}

‎advisories/unreviewed/2026/09/GHSA-27vc-6rpf-73gh/GHSA-27vc-6rpf-73gh.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27vc-6rpf-73gh",
4+
"modified": "2026-09-16T12:30:43Z",
5+
"published": "2026-09-16T12:30:43Z",
6+
"aliases": [
7+
"CVE-2026-89951"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix stale receive device on merged fragments\n\nFragment reassembly reuses the skb from the highest-numbered buffered\nfragment as the merged packet. When that fragment was received on a hard\ninterface which is deleted before the chain completes, the merged skb can\nre-enter the receive path with a stale skb->dev and skb_iif.\n\nbatadv_batman_skb_recv() passes such merged packets through the normal\nreceive handlers again. DAT and bridge loop avoidance both derive the ARP\nheader length from skb->dev, so they can dereference the freed net_device\nbefore the packet reaches the local mesh interface.\n\nRefresh the receive device metadata from the current receive device before\nrunning the packet handlers. This keeps internally reinjected merged\nfragments consistent with the normal receive path after hard interface\nteardown.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89951"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/2dffc8c44b6e3347b3719c6419c07b4a18fea895"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/63d86250fa7cbe22451369bd1c0881dfc8190958"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/6df64825f8b199921120c685af2abca14b077331"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/a2c272da99c2077088083c14961cf2f1e4506995"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/ad46c907d7d9975a285c1e89a4adde652eaa93f5"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/e91d2cc7441d89a45bad73ad9789159c7441cb80"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://git.kernel.org/stable/c/f4b4ae763b5d59319fad62a00c76676758e7dafa"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://git.kernel.org/stable/c/f830c2dfc1431764db9256b3d5db1695fc9a7f56"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [],
52+
"severity": null,
53+
"github_reviewed": false,
54+
"github_reviewed_at": null,
55+
"nvd_published_at": "2026-09-16T11:17:05Z"
56+
}
57+
}

‎advisories/unreviewed/2026/09/GHSA-2c46-6532-v7c3/GHSA-2c46-6532-v7c3.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2c46-6532-v7c3",
4+
"modified": "2026-09-16T12:30:38Z",
5+
"published": "2026-09-16T12:30:37Z",
6+
"aliases": [
7+
"CVE-2026-89822"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Guard against NULL driver_data in i915_pci_probe()\n\npci_match_device() can return the dummy pci_device_id_any entry\nwhen a device is force-bound via sysfs driver_override, in which\ncase ->driver_data is unset (NULL). i915_pci_probe() casts it to\nstruct intel_device_info * unconditionally and dereferences\nintel_info->require_force_probe, causing a NULL-ptr-deref.\n\n(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89822"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/18b3433f10ee9c69e3252046028aa2be421f2d4d"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/3785d40831ba5601296283e0197e10e089392757"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/4a0236fe97732e31cb4a6dcb433642f9e3ef9a56"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/84829e324a396668ceafb14723293b2863a74dcf"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8"
40+
}
41+
],
42+
"database_specific": {
43+
"cwe_ids": [],
44+
"severity": null,
45+
"github_reviewed": false,
46+
"github_reviewed_at": null,
47+
"nvd_published_at": "2026-09-16T11:16:47Z"
48+
}
49+
}

‎advisories/unreviewed/2026/09/GHSA-2c95-6v37-x3vh/GHSA-2c95-6v37-x3vh.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2c95-6v37-x3vh",
4+
"modified": "2026-09-16T12:30:40Z",
5+
"published": "2026-09-16T12:30:40Z",
6+
"aliases": [
7+
"CVE-2026-89899"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: disable delayed work before freeing an interrupted transmit\n\ncec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in\nwait_for_completion_killable(). If that wait is interrupted by a signal,\ncancel_delayed_work_sync() can run before the CEC kthread arms the reply\ntimeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts().\nThe work is then armed after the cancel, and the data is freed with its\ndelayed_work still pending:\n\n ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout\n\nUse disable_delayed_work_sync(): it cancels the work and disables it, so\nthe later schedule_delayed_work() becomes a no-op and the work cannot be\nre-armed. The data is freed right after, so it need not be re-enabled.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89899"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2026-09-16T11:16:58Z"
40+
}
41+
}

‎advisories/unreviewed/2026/09/GHSA-2f2m-wrrx-qjxp/GHSA-2f2m-wrrx-qjxp.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f2m-wrrx-qjxp",
4+
"modified": "2026-09-16T12:30:37Z",
5+
"published": "2026-09-16T12:30:37Z",
6+
"aliases": [
7+
"CVE-2026-89806"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: ofdrm: Fix integer overflow in fb_size calculation\n\nThe framebuffer size calculation `fb_size = linebytes * height` can\noverflow when both values are large (e.g., 46341 * 46341 > INT_MAX).\nSince linebytes and height are both int types, the multiplication is\nperformed as int * int, which results in undefined behavior on overflow.\n\nUse check_mul_overflow() to detect and prevent this overflow, consistent\nwith the approach used in simpledrm.c and corebootdrm.c.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89806"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-09-16T11:16:45Z"
36+
}
37+
}

0 commit comments

Comments
 (0)