Search vulnerabilities

Results 3,940

Export CSV
CVE-2026-98418

sched/core: Avoid false migration warning for proxy donors

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its original execution CPU remains recorded in wake_cpu. set_task_cpu() warns unconditionally for migration-disabled tasks, so a subsequent proxy migration or the wakeup path returning the donor home triggers a false positive: moving a blocked scheduling context does not violate the migration-disabled execution context. For example, creating a mutex owner on CPU1 and a migration-disabled waiter on CPU0 can trigger the following warning: proxy_migrate_repro: donor blocking on CPU0 with migration disabled proxy_migrate_repro: donor moved from CPU0 to CPU1 WARNING: kernel/sched/core.c:3389 at set_task_cpu+0x1d3/0x280 ... Call Trace: try_to_wake_up+0x43f/0x780 __mutex_unlock_slowpath+0x330/0x540 owner_fn+0x9f/0xc0 [proxy_migrate_repro] ... proxy_migrate_repro: donor woke on CPU0, task_cpu=0 proxy_migrate_repro: completed Exclude blocked proxy donors from the warning. The proxy wakeup path restores an executable placement before clearing the blocked state.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Products
CVE-2026-102740

AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
CVE-2026-102070

Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used

A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Products
CVE-2026-102000

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102071

Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102041

Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled

A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102042

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102044

Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
CVE-2026-102063

Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Products
CVE-2026-102064

Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
CVE-2026-102011

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102012

Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled

A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Products
CVE-2026-102058

Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled

A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-101964

Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-98406

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Products
CVE-2026-102020

Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled

A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
CVE-2026-102022

Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
CVE-2026-102023

Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used

A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Products
CVE-2026-102034

Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled

A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
CVE-2026-102035

Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled

A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed