CVE-2026-63986
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failur
CVSS
5.5
Medium
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Jul 19, 2026 · Last modified: Oct 8, 2026 · CWE-763
0.1%EPSS · 30 days0.2%
2026-09-262026-10-23
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg. There's nothing to cancel, and passing an error pointer to genlmsg_cancel() would cause a crash.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-112893—20.6%
——6Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.5dCVE-2026-689085.3 MED38.2%
——11libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.9dCVE-2026-970118.8 HIG53.5%
——16Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.10dCVE-2026-858507.8 HIG26.7%
——8Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.12dCVE-2026-853627.0 HIG15.7%
——5Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.9dCVE-2026-839087.0 HIG18.2%
——5Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.9d