CVE-2024-43858
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree
CVSS
7.8
Alto
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Publicado: 17 ago 2024 · Última mod.: 4 ago 2026 · CWE-129
0.2%EPSS · 30 días0.2%
2026-07-292026-08-26
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree
- git.kernel.orghttps://git.kernel.org/stable/c/538a27c8048f081a5ddd286f886eb986fbbc7f80
- git.kernel.orghttps://git.kernel.org/stable/c/55b732c8b09b41148eaab2fa8e31b0af47671e00
- git.kernel.orghttps://git.kernel.org/stable/c/63f7fdf733add82f126ea00e2e48f6eba15ac4b9
- git.kernel.orghttps://git.kernel.org/stable/c/6aa6892a90a5a7fabffe5692ab9f06a7a46c6e42
- git.kernel.orghttps://git.kernel.org/stable/c/8d8f9a477de0d7962342eedf2a599215b7c63d28
- git.kernel.orghttps://git.kernel.org/stable/c/9b3a4345957f5372041bc4f59de322f62653e862
- git.kernel.orghttps://git.kernel.org/stable/c/f73f969b2eb39ad8056f6c7f3a295fa2f85e313a
- git.kernel.orghttps://git.kernel.org/stable/c/ff14eadc278663cac69d57d3ca7fb2f394e1f8a7
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-132128.8 ALT12.8%
——4The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len).
Because the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq->num. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt.
The result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id >= vq->num before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.3dCVE-2026-170977.3 ALT1.5%
——0IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.2dCVE-2026-168494.3 MED9.7%
——3IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.3dCVE-2026-658328.2 ALT22.4%
——7Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.10dCVE-2026-492825.1 MED3.0%
——1Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.10dCVE-2026-734894.3 MED17.3%
——5Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.10d