All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Rivian launched Autonomy+, an advanced driver-assistance system (ADAS, technology that can control a vehicle's speed, braking, and steering), in May 2026 to compete with Tesla's FSD (Full Self-Driving). While Rivian's system surpasses older competitors like GM's Super Cruise on highways, it still lags Tesla's FSD in handling non-highway driving and point-to-point navigation (where a vehicle drives itself from start to finish without human control). Rivian plans to add point-to-point capabilities later in 2026 as its next major upgrade.
A vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter, a in-kernel virtual machine) map handling was fixed by changing how special fields are cleaned up when map values are recycled. Previously, full field destruction could occur in NMI context (non-maskable interrupt, a high-priority CPU interrupt), which is unsafe for certain destructors like kptr (kernel pointer) cleaners and graph operations. The fix introduces a new NMI-safe cleanup function that only handles timers, workqueues, and task_work, while deferring more complex field destruction to the final cleanup phase.
A vulnerability in the Linux ext4 filesystem allowed a deadlock (situation where two processes wait forever for each other) when using the EXT4_IOC_MOVE_EXT ioctl (a system call that moves data between files) with a file from a different filesystem. The problem occurred because the filesystem validation happened too late, after locks were already acquired, creating a circular dependency with freeze operations.
A Linux kernel vulnerability allowed the flow_dissector (the part that examines packet headers to classify network traffic) to read 12 bytes of uninitialized memory from packets on non-Ethernet devices like TUN adapters in L3 mode, which don't have Ethernet headers where the code expected them. This corrupted memory could then be used as a lookup key in the kernel, potentially causing unpredictable behavior.
A Linux kernel bug in MIDI 2.0 audio processing caused a use-after-free vulnerability (accessing memory that has already been freed) when URBs (USB request blocks, which are data transfers over USB) were not properly stopped before their memory was released during setup failures. This could lead to system crashes when the USB completion handler tried to access freed memory.
A TOCTOU race condition (a vulnerability where data changes between when it's checked and when it's used) existed in the Linux kernel's network packet scheduling module, allowing an attacker with admin privileges to write beyond allocated memory boundaries. The fix involves reading the key count value while holding a lock in all relevant locations and adding stricter capacity checks that reject operations exceeding available space rather than silently truncating them.
A vulnerability in KVM (the Linux kernel's virtual machine module) was fixed by moving a consistency check for vTPR (virtual task priority register) and TPR Threshold into an earlier validation stage. The bug occurred because the check was happening too late in the process, allowing KVM to run with incorrect memory settings when nested virtualization (running a virtual machine inside another virtual machine) was enabled.
A vulnerability in the Linux kernel's NTFS file system allows attackers to read memory beyond intended boundaries by crafting a malicious disk image with mismatched length fields in file name attributes. The flaw occurs because the kernel trusts embedded length values without proper validation, potentially exposing sensitive data when the system tries to read or compare file names.
A bug in the Linux kernel's OpenRISC architecture prevented instruction cache (icache, the processor's fast memory that stores recently-used instructions) from being properly synchronized across multiple CPU cores when updating static keys (a kernel optimization technique that switches code paths at runtime). After an update, some cores would still execute old code because their caches weren't properly cleared.
A vulnerability in Linux kernel TPM (Trusted Platform Module, a security chip) character devices allowed attackers to read or write memory outside intended bounds by using positional I/O operations (pread/pwrite) with large offsets, potentially causing crashes or information leaks. The kernel was leaving these devices seekable (able to jump to arbitrary positions) when they should only support sequential access.
A vulnerability in the Linux kernel's CAN (controller area network, a protocol for vehicle communication) module allowed race conditions when multiple network interfaces sent matching frames to the same operation with timers enabled, causing corrupted data and false timeout alerts. The fix tracks which interface first delivers a frame to an operation and rejects frames from other interfaces, preventing the concurrent access problems.
A vulnerability in the Linux kernel's real-time spinlock code allowed a use-after-free (UAF, accessing memory after it has been freed) because rt_spin_unlock() was releasing RCU protection (a mechanism that prevents memory from being freed during critical sections) too early. The fix moves the rcu_read_unlock() call to happen after the unlock operation completes, matching how regular spinlocks protect memory and preventing the window where freed memory could be accessed.
A bug in the Linux kernel's ca8210 wireless driver caused pointer truncation (cutting off part of a memory address) on 64-bit systems. The code was passing only 4 bytes when trying to store 8-byte pointers through a kfifo (a data structure for passing items between parts of the kernel), resulting in corrupted addresses that would crash the system when accessed.
A vulnerability in the Linux kernel's ueagle-atm USB driver occurs because it loads firmware asynchronously (request_firmware_nowait(), a non-blocking function that continues without waiting for firmware to load) but doesn't wait for it to finish before unplugging the device, causing the firmware sysfs fallback mechanism (CONFIG_FW_LOADER_USER_HELPER, a method to load firmware through user space when direct loading fails) to race with device teardown and create errors in kernfs (the Linux kernel's file system interface). This race condition has triggered multiple bug reports over several years when devices are unplugged during firmware loading.
OpenAI's CFO Sarah Friar announced that the company's enterprise business (sales to companies) now generates more revenue than its consumer business (ChatGPT for individual users), crossing the 50% threshold ahead of previous expectations with a $40 billion annualized revenue run rate. The shift reflects a change in how enterprise customers use AI, moving away from "tokenmaxxing" (letting employees accumulate large AI costs without tracking outputs) toward measuring cost per unit of intelligence and efficiency.
OpenAI is experiencing a significant departure of senior executives, including Chief Revenue Officer Denise Dresser, Operating Chief Brad Lightcap, and others, just as the company prepares for an expected initial public offering (IPO, or the first time a company's stock is sold to the public). Industry observers view these exits as a warning sign that could undermine investor confidence, especially given competition from rivals like Google and Anthropic.
The Cortex MCP server (a tool that lets AI assistants like Claude access persistent memory across projects) before version 3.17.1 has a vulnerability where it trusts the project directory set by Claude Code without proper validation. An attacker can place two specific files (`mcp_server/` folder and `ui/unified-viz.html`) in a malicious repository to trick Cortex into running arbitrary Python code with the user's privileges when the `open_visualization` tool is used.
Secondhand booksellers across the UK, Ireland, and other countries are reporting unusual bulk book orders from mystery buyers, with suspicion that AI companies are purchasing these books to collect text data for training their models. This follows reports that Anthropic, an AI company, spent millions acquiring books to scan for data acquisition purposes.
Fix: The fix involves introducing bpf_obj_cancel_fields() for the reusable-value path that performs only NMI-safe cleanup for timer, workqueue, and task_work fields. Array and hashtab update/delete/recycle paths were switched to use this cancel helper instead of the full bpf_obj_free_fields() function. The bpf_obj_free_fields() function is retained for final map destruction and bpf_mem_alloc destructors.
NVD/CVE DatabaseFix: Move the superblock validation check to occur before any lock acquisition. The source states: 'Moving the superblock check before any lock acquisition is both semantically correct and eliminates the circular dependency by ensuring that cross-filesystem donor fds are rejected before sb_writers or inode locks are taken.'
NVD/CVE DatabaseFix: The fix gates the memory read operation on two checks: (1) verify that dev->type == ARPHRD_ETHER (the device is actually Ethernet), and (2) check skb_mac_header_was_set() to ensure the mac_header pointer is valid. This ensures the code only reads Ethernet address data from actual Ethernet-framed packets, and on non-Ethernet devices, the key is zeroed instead of reading garbage memory.
NVD/CVE DatabaseFix: Make the endpoint destructor follow the same teardown ordering used during disconnect: publish the endpoint's disconnected status, kill the URBs synchronously (stop them and wait for completion), and drain the endpoint before freeing URB buffers and endpoint storage. A guard prevents repeating this stop sequence after the normal disconnect path, while still synchronizing the direct MIDI 2.0 create-error free path.
NVD/CVE DatabaseFix: The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places using a new tcf_pedit_nkeys_locked() function which replaces the old tcf_pedit_nkeys(). Additionally, remaining capacity checks are enforced, returning -ENOSPC (no space error) if the required space exceeds remaining capacity, rather than silently truncating the key count.
NVD/CVE DatabaseFix: Move the vTPR vs. TPR Threshold consistency check into the 'normal' controls checks that happen earlier in the process. Access vTPR using a regular guest memory access instead of deferring the check. Use a VM-scoped API to read guest memory to ensure it accesses the correct memory locations, and skip the check when userspace is restoring state. If reading guest memory fails, skip the consistency check, since reads from non-existent memory return 0xFF, which guarantees vTPR is greater than or equal to TPR_THRESHOLD.
NVD/CVE DatabaseFix: Add a shared attribute value validator that checks resident value bounds, minimum sizes, variable-length file name fields, and non-resident metadata before returning attributes from lookup functions. Apply this validation across all lookup paths, including the AT_UNUSED case, and reject non-resident $FILE_NAME records since the format requires them to be resident.
NVD/CVE DatabaseFix: Fix SMP cache syncing (synchronization across multiple processors) by: (1) Properly invalidate remote core icaches on SMP systems by using icache_all_inv instead of kick_all_cpus_sync(), and (2) For architectures without WRITETHROUGH caches (caches that write changes to main memory immediately), flush the dcache (data cache, the fast memory storing recently-used data) after patching the code.
NVD/CVE DatabaseFix: Call nonseekable_open() from both TPM device open handlers. This removes positional read/write flags (FMODE_PREAD and FMODE_PWRITE), causing pread() and pwrite() to fail with -ESPIPE (an error code meaning the operation is not supported on this file type) before reaching vulnerable code, while preserving normal sequential read() and write() functionality.
NVD/CVE DatabaseFix: Add op->if_detected to track the first interface delivering a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that operation. The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values. A claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state.
NVD/CVE DatabaseFix: Move the rcu_read_unlock() invocation past the unlock operations in rt_spin_unlock() to match non-RT semantics. The migrate_enable() call remains before the unlock operation. This change applies to both spinlock and rwlock (reader-writer lock) substitutions.
NVD/CVE DatabaseFix: Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture.
NVD/CVE DatabaseFix: The fix involves waiting for the pre-firmware load in the .disconnect() handler by calling wait_for_completion() in the device disconnection function, ensuring the firmware load completes before the device is torn down.
NVD/CVE DatabaseThis research paper presents a comprehensive analysis of privacy threats in smart home systems, which are networked devices (like cameras, thermostats, and speakers) that collect data about your home and habits. The authors develop a privacy threat analysis (PTA) framework to identify and categorize different ways your personal information could be exposed or misused in these systems, and propose a risk management approach to help reduce those dangers. The work is intended to help engineers and developers build smarter homes that better protect residents' privacy.
Anthropic is implementing invisible watermarking in Claude to help identify AI-generated text, complying with EU regulations requiring AI companies to mark their outputs. The watermark works by subtly changing how Claude picks words during text generation (using a secret key to influence the randomness when selecting each word), creating an undetectable pattern that only someone with the key can verify, without affecting the quality or readability of the output.
Fix: Update to version 3.17.1 or later, which fixes the issue.
NVD/CVE Database