Microsoft Security Response Center

xfs: resample the data fork mapping after cycling ILOCK

Process Kill Attack Vector in killall() in seunshare

Local File Deletion Attack Vector in rm_rf() in seunshare

Chromium: CVE-2026-16807 Out of bounds write in Codecs

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Chromium: CVE-2026-16806 Use after free in WebMCP

Chromium: CVE-2026-16805 Use after free in Blink

Chromium: CVE-2026-16804 Use after free in Input

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate.

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

DNS Cookie bypass when combined with proxy-protocol use

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Memory corruption could lead to crash and denial of service

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

'max-global-quota' reset by DNSSEC validation restarts

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

SQL injection in syslog-ng SQL destionation driver

i2c: stub: Reject I2C block transfers with invalid length

Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

net: team: fix NULL pointer dereference in team_xmit during mode change

i2c: i801: fix hardware state machine corruption in error path

xfs: fail recovery on a committed log item with no regions

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

riscv: Fix register corruption from uninitialized cregs on error

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

net/handshake: Drain pending requests at net namespace exit

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

net/handshake: hand off the pinned file reference to accept_doit

netfs: Fix leak of request in netfs_write_begin() error handling

netfilter: bridge: eb_tables: close module init race

rbd: eliminate a race in lock_dwork draining on unmap

drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()

lsm: hold cred_guard_mutex for lsm_set_self_attr()

usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

usb: typec: altmodes/displayport: validate count before reading Status Update VDO

drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

usb: typec: ucsi: ccg: reject firmware images without a ':' record header

net/sched: fix packet loop on netem when duplicate is on

netfilter: x_tables: add and use xtables_unregister_table_exit

hpfs: fix a crash if hpfs_map_dnode_bitmap fails

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

usb: typec: ucsi: validate connector number in ucsi_connector_change()

usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

security/keys: fix missed RCU read section on lookup

powerpc/hv-gpci: fix preempt count leak in sysfs show paths

usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

ksmbd: validate SID in parent security descriptor during ACL inheritance

netfs: Fix potential for tearing in ->remote_i_size and ->zero_point

ALSA: pcm: oss: Fix setup list UAF on proc write error

netfilter: x_tables: allocate hook ops while under mutex

cgroup/rstat: validate cpu before css_rstat_cpu() access

hwmon: (lm90) Stop work before releasing hwmon device

apparmor: fix use-after-free in rawdata dedup loop

NFSD: Fix SECINFO_NO_NAME decode error cleanup

ksmbd: reject non-VALID session in compound request branch

f2fs: validate ACL entry sizes in f2fs_acl_from_disk()

ksmbd: fix out-of-bounds read in smb_check_perm_dacl()

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

blk-cgroup: fix UAF in __blkcg_rstat_flush()

mac802154: llsec: add skb_cow_data() before in-place crypto

gfs2: fix use-after-free in gfs2_qd_dealloc

f2fs: validate compress cache inode only when enabled

rpmsg: char: Fix use-after-free on probe error path

pNFS: Fix use-after-free in pnfs_update_layout()

keys: Pin request_key_auth payload in instantiate paths

irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

KEYS: fix overflow in keyctl_pkey_params_get_2()

wifi: rtw88: usb: fix memory leaks on USB write failures

KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

fuse: re-lock request before replacing page cache folio

net: skmsg: preserve sg.copy across SG transforms

serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level

batman-adv: v: prevent OGM aggregation on disabled hardif

iio: light: veml6075: add bounds check to veml6075_it_ms index

wifi: mt76: add wcid publish check in mt76_sta_add

f2fs: validate orphan inode entry count

netfilter: nf_tables: add hook transactions for device deletions

nfsd: release layout stid on setlease failure

esp: fix page frag reference leak on skb_to_sgvec failure

Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls

i2c: core: fix adapter registration race

f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage

drm/msm: always recover the gpu

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

ntfs: serialize volume label accesses

f2fs: read COW data with the original inode during atomic write

fbdev: omap2: fix use-after-free in omapfb_mmap

f2fs: fix to do sanity check on f2fs_get_node_folio_ra()

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

gcov: use atomic counter updates to fix concurrent access crashes