Open Source Security Mailing List

Discussion of security flaws, concepts, and practices in the Open Source community

List Archives

Latest Posts

CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape fourie (Oct 13)
Hi all,

We are disclosing Vghost (CVE-2026-74580), a stale IOTLB metadata-cache
vulnerability affecting Linux vhost frontends.

Impact
------

- Local user with access to /dev/vhost-* -> arbitrary kernel read/write -> root.
- Guest using vIOMMU + iommu_platform + VIRTIO_F_RING_RESET -> QEMU heap
overwrite, and control-flow hijacking.

Bug
---

vq->meta_iotlb[] caches the IOTLB mappings for the descriptor, available,
and used rings....

Hex 2.5.2 released with security fixes Alan Coopersmith (Oct 13)
https://github.com/hexpm/hex/releases/tag/v2.5.2 lists:

The listed GHSA ids can be found on:
https://github.com/hexpm/hex/security/advisories

rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) Rainer Gerhards (Oct 13)
Hello,

rsyslog has disclosed GHSA-48f2-29wv-5jgc, an output length overflow in
RainerScript replace(). The three-argument form of wrap() uses the same
helper. This is not exposed by rsyslog's default small-message configuration.

An affected deployment needs both an explicit ruleset that passes
attacker-influenced values to replace() or three-argument wrap(), and a
maxMessageSize large enough to accept the source and replacement values.
The...

Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 Thomas GERBET (Oct 13)
Hello,

The Nix and Lix projects are jointly disclosing a set of
vulnerabilities that can be combined to escalate privileges to root on
systems running the Nix or Lix daemon. Fixed releases of both projects
are available today. This is a coordinated disclosure between the Nix
and Lix projects. CVE IDs have not yet been requested.

Issues affecting both Nix and Lix
=========================

CVE-2026-XXXXX [list overflow]
Unsigned integer...

Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-102701 / XSA-521
version 2

tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

Tapdisk is a userspace xen-blkback implementation used by the XAPI
toolstack.

During connection, multi-page rings may be negotiated between the
frontend and backend. Tapdisk had no...

Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-102700 / XSA-520
version 2

gnttab: cache-flush handling may cause page reference leak

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

With its original introduction, GNTTAB_cache_flush was made available
uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL
pointer check, yet the addition of that check...

Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-102699,CVE-2026-102702 / XSA-519
version 2

Arm: multiple issues with GNTTABOP_cache_flush

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there...

Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-79611 / XSA-518
version 2

VMX: VMentry failure with branch tracing and blocked states

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

For XSA-308 logic was introduced, as VMX VMEntry checks do not like the
exact combination of state which occurs when #DB in intercepted, Single
Stepping is active, and blocked by...

Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-79610 / XSA-517
version 2

grant-table: double version change race

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations. Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't...

Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-79609 / XSA-516
version 2

x86: XPTI may break on huge-memory systems

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page...

Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-79608 / XSA-515
version 2

x86/AMD: ineffectual Zenbleed workaround

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced,...

Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update Xen . org security team (Oct 13)
Xen Security Advisory CVE-2026-79607 / XSA-514
version 2

Xenstore: Guests can crash xenstored during Live Update

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

During Xenstore live update the state record for a Xenstore watch with
specified watch depth is written with two bytes missing. This results
in an inconsistent state when reading the...

CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan (Oct 13)
Severity: moderate

Affected versions:

- Apache Fesod (Incubating) 2.0.2-incubating

Description:

Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating)
fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled
image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a...

Fwd: Announcing FreeType version 2.15.0 Alan Coopersmith (Oct 12)
While the notes below only mention the fix for CVE-2026-95512,
the CVE record for CVE-2026-50811 also lists a commit included
in this release.

The git log also mentions pulling in the fix for CVE-2026-27171
to the vendored copy of zlib 1.3.1 included in FreeType.

-alan-

-------- Forwarded Message --------
Subject: Announcing FreeType version 2.15.0
Date: Mon, 12 Oct 2026 21:18:47 +0000
From: Werner LEMBERG <wl () gnu...

[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 Christian Brabandt (Oct 12)
Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178
===============================================================
Date: 12.10.2026
Severity: Medium
CVE: *requested, not yet assigned*
CWE: Improper Neutralization of Special Elements used in an OS Command
(CWE-78), Improper Input Validation (CWE-20)

## Summary
The R Markdown syntax script in `runtime/syntax/rmd.vim` collects the language
names of code chunks from the buffer...

More Lists

Dozens of other network security lists are archived at SecLists.Org.