30
30
WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf
The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.
12
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.
ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
18
ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability
ZDI-26-699: Linux Kernel NTFS3 out-of-bounds read (CVSS 5.2) lets local low-privileged attackers disclose sensitive information.
ZDI advisory ZDI-26-699 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 5.2. An attacker must already have the ability to execute low-privileged code on the target system to trigger the flaw. Successful exploitation results in information disclosure. No CVE identifier is listed in the advisory.
15
ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.
ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.
15
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
18
ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability
The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.
ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.
25
ZDI-26-576: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability
ZDI disclosed a race condition local privilege escalation flaw in the Linux Kernel XFRM subsystem, CVSS 7.5, with no CVE assigned.
The Zero Day Initiative published ZDI-26-576 describing a race condition in the Linux Kernel XFRM subsystem. Local attackers can escalate privileges, but the advisory states an attacker must first be able to execute high-privileged code on the target. ZDI assigned a CVSS score of 7.5; no CVE identifier is listed in the advisory text.
20
Re: Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 includes vulnerability fixes, with a commit link shared for downstream tracking but no CVEs cited.
An oss-security post links a util-linux commit (286dd3ff41526b582ef48830de239dffbaa61f90) as part of the 2.42.3 vulnerability fix release. No CVE identifiers, flaw descriptions, or exploitation details are provided. The item is a routine open-source fix notification for downstream distributors.
22
30
30
35
30
30
30
30
35
30
30
35
35
30