cyberstan

  • 15-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533

    15-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533

    CVE-2026-42533 · Fixed in nginx 1.30.4 / 1.31.3 · Affected: nginx 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline) · NGINX Plus R33–R36 (fixed in R36 P7) and 37.0.0.1–37.0.2.1 (fixed in 37.0.3.1)· F5 Advisory · Reported by Stan Shaw A note for defenders If you run nginx with map directives that use regex patterns and any…

  • Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)

    Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)

    CVE-2026-31694 · Fixed in mainline (51a8de6), 20 April 2026, Cc: stable · Fixes 69e3455 · Latent since 69e3455 (2018) · Affected: v6.16 through the fix · Reported by Qi Tang and Zijun Hu · Fix authored by Samuel Page Summary A missing bounds check in fs/fuse/readdir.c lets an unprivileged local user write a controlled 24…

  • Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)

    Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)

    Reported to security@kernel.org, 12 April 2026 · Fixed in mainline (5e28b7b), May 2026, Cc: stable · Fixes 53096728 · Affected: v6.18-rc1 through the fix · CVE-2026-46215 (reported independently; credited to another researcher, see the disclosure section) Summary A use-after-free in the DRM GEM core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE lets any local user with access to a render…

  • Bounding against the wrong buffer: an OOB read/write in KVM SEV-SNP (CVE-2026-53360)

    Bounding against the wrong buffer: an OOB read/write in KVM SEV-SNP (CVE-2026-53360)

    Reported to security@kernel.org, 8 April 2026 · Fixed in mainline (db3f219), May 2026, Cc: stable · Fixes 4af663c · Affected: KVM SNP host support, ~v6.10 through the fix · CVE-2026-53360 (track commit db3f219 on linux-cve-announce) Summary A malicious SEV-SNP guest can corrupt the host kernel’s heap and leak information about its layout, through the way…

  • Guest-to-host escape via QEMU CXL Type 3 mailbox overflows

    Guest-to-host escape via QEMU CXL Type 3 mailbox overflows

    6th April 2026 · Reported to qemu-security · Classified as non-security (CXL outside policy scope) · Found by manual code audit Summary Three bugs in QEMU’s CXL Type 3 mailbox emulation (hw/cxl/cxl-mailbox-utils.c) chain into a deterministic guest-to-host escape with full ASLR bypass. The escape gets you arbitrary code execution on the host from a guest…

  • Use-after-free in CPython’s perf_trampoline via unsynchronised arena teardown

    Use-after-free in CPython’s perf_trampoline via unsynchronised arena teardown

    January 2026 · CPython Issue #143228 · Fix PR #143233 · Patched in 3.13/3.14, 3.12 marked Won’t Fix Summary A use-after-free in CPython’s perf_trampoline implementation, triggered when sys.deactivate_stack_trampoline() runs concurrently with active bytecode execution on worker threads. The cleanup function free_code_arenas calls munmap on executable memory pages without checking whether other threads are currently executing…

  • Technical Write-up: SQL Injection in Django ORM CVE-2025-64459

    Technical Write-up: SQL Injection in Django ORM CVE-2025-64459

    November 2025 · CVE-2025-64459 (CVSS 9.1) · Fixed in Django 5.2.8, 5.1.14, 4.2.26 Summary Django’s WhereNode.as_sql formatted the query connector (AND / OR) into the generated SQL via unchecked %s string interpolation. Because the connector value is attacker-reachable through the _connector key of a Q object — and because the common pattern Q(**user_input) unpacks request…