Updated CVEs from Tenable

High Severity Description A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed content. Successful exploitation could affect system confidentiality, integrity, and availability, and may disrupt trusted interactions among system functions. Read more at https://www.tenable.com/cve/CVE-2026-95785

Medium Severity Description A vulnerability exists in a system interface that may, under certain conditions, fail to properly enforce authorization boundaries. Successful exploitation could allow an unauthorized party to access or modify protected system information, potentially affecting confidentiality and integrity. Read more at https://www.tenable.com/cve/CVE-2026-95786

High Severity Description A vulnerability exists in a network-facing component that may, under certain conditions, result in service disruption. Successful exploitation could cause temporary unavailability of affected functionality. Read more at https://www.tenable.com/cve/CVE-2026-95783

High Severity Description A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services. Successful exploitation could result in temporary service interruption or loss of functionality. Read more at https://www.tenable.com/cve/CVE-2026-95784

High Severity Description A vulnerability exists in a monitoring component that may, under certain conditions, allow security controls to be circumvented. Successful exploitation could result in unauthorized access to information intended for authorized users only. Read more at https://www.tenable.com/cve/CVE-2026-95782

High Severity Description A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system functions. Successful exploitation could result in a compromise of service integrity or unauthorized system access. Read more at https://www.tenable.com/cve/CVE-2026-95781

High Severity Description In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Read more at https://www.tenable.com/cve/CVE-2026-95405

High Severity Description A vulnerability exists in the authentication and session-management mechanisms that may result in access not being fully terminated following certain account or session state changes. Under specific conditions, a remote user with prior legitimate access could retain access to protected system resources beyond the intended authorization period. Successful exploitation could result in continued unauthorized access. Read more at https://www.tenable.com/cve/CVE-2026-95780

Medium Severity Description In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. Read more at https://www.tenable.com/cve/CVE-2026-95402

High Severity Description In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Read more at https://www.tenable.com/cve/CVE-2026-95400

Medium Severity Description In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Read more at https://www.tenable.com/cve/CVE-2026-95399

Medium Severity Description In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. Read more at https://www.tenable.com/cve/CVE-2026-95397

Medium Severity Description In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()’s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532 Read more at https://www.tenable.com/cve/CVE-2026-99287

Medium Severity Description In the Linux kernel, the following vulnerability has been resolved: inet: reject unhashed sockets during established lookups TCP established ehash lookups are lockless. The socket caches involved use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader that retained its old address has finished. After a tuple match, __inet_lookup_established() and __inet6_lookup_established() acquire a reference and repeat the tuple check. They do not check whether the new object is hashed. If the address is reused for a socket with the same tuple, the lookup can acquire a reference to the new object and return it while its nulls node is unhashed. A PoC that drives reuse with a SYN cookie request socket reproduced the crash. The new request socket is unhashed and has a NULL rsk_listener. A lookup that had loaded the address of the old request socket acquired the reference published by tcp_get_cookie_sock() and returned the new object. tcp_v4_rcv() then read sk_state through the NULL listener. The resulting crash was: BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) – not-present page … Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy) … RIP: 0010:tcp_v4_rcv+0x44e/0x1280 … R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000 … CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0 … Call Trace: ? raw_local_deliver+0xae/0x240 ip_protocol_deliver_rcu+0x2d/0x180 ip_local_deliver_finish+0x84/0x100 ip_sublist_rcv_finish+0x5f/0x70 ip_sublist_rcv+0x12a/0x1d0 ip_list_rcv+0xfd/0x130 __netif_receive_skb_list_core+0x223/0x250 netif_receive_skb_list_internal+0x1d2/0x2c0 ? try_fill_recv+0x39/0x7b0 napi_complete_done+0x74/0x170 virtnet_poll+0x445/0x600 __napi_poll+0x27/0x1e0 net_rx_action+0x2fe/0x3b0 handle_softirqs+0xc2/0x2c0 __irq_exit_rcu+0x74/0xd0 common_interrupt+0x7f/0x90 … Kernel panic – not syncing: Fatal exception in interrupt After taking a reference, check whether the nulls node is unhashed in both IPv4 and IPv6 established lookups. If it is unhashed or the tuple no longer matches, drop the reference and restart the lookup. Lookups racing with the TIME_WAIT hashdance, or with a request being replaced by its child, now restart and find the new socket instead of returning the old one. Request sockets that were never inserted into ehash can have a nonzero refcount, and a stale lookup can hold a transient reference. Therefore, when SYN cookie, Fast Open, and request migration paths fail after setting a nonzero refcount, release the references held by those paths with reqsk_put() instead of freeing the request directly. Read more at https://www.tenable.com/cve/CVE-2026-99288

High Severity Description In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 (“xen-netback: fix race condition on XenBus disconnect”). This is XSA-531 Read more at https://www.tenable.com/cve/CVE-2026-99286

High Severity Description Access of resource using incompatible type (‘type confusion’) in Windows Shell allows an authorized attacker to elevate privileges locally. Read more at https://www.tenable.com/cve/CVE-2026-97013

Medium Severity Description Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Read more at https://www.tenable.com/cve/CVE-2026-97015

High Severity Description Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally. Read more at https://www.tenable.com/cve/CVE-2026-97002

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-97006

High Severity Description Use after free in Winsock allows an authorized attacker to elevate privileges locally. Read more at https://www.tenable.com/cve/CVE-2026-96994

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-96988

Medium Severity Description Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. Read more at https://www.tenable.com/cve/CVE-2026-96989

High Severity Description Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. Read more at https://www.tenable.com/cve/CVE-2026-97000

High Severity Description Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network. Read more at https://www.tenable.com/cve/CVE-2026-96993

Medium Severity Description Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. Read more at https://www.tenable.com/cve/CVE-2026-96992

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-96984

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-96986

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-96987

Medium Severity Description Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. Read more at https://www.tenable.com/cve/CVE-2026-96985

Medium Severity Description Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. Read more at https://www.tenable.com/cve/CVE-2026-96983