MontaVista CVE List and Response
MontaVista continually monitors the security community and customers for threats. We follow the community on CVE scoring (NVD) and set fix priority accordingly for affected products. Please view the following CVEs that have been remediated or are in process by clicking the CVE Year to the left or use the CVE Filters below.
For inquiries regarding Security Vulnerabilities, please see our Vulnerability Response Policy or email our PSIRT team security@mvista.com. Email messages and attachments can be encrypted using PGP and a MontaVista PSIRT PGP key, which is available for download here.
| CVE | Score | Severity | Package | Description | Published |
|---|---|---|---|---|---|
| CVE-2026-35334 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-08-11 |
| CVE-2026-73281 |
3.5 (i)
| LOW | openssh | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension. | 2026-08-11 |
| CVE-2026-72693 |
7.8 (i)
| HIGH | kbd | `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path. | 2026-08-11 |
| CVE-2026-6426 |
4.4 (i)
| MEDIUM | qemu | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration. | 2026-08-10 |
| CVE-2026-63622 |
7.8 (i)
| HIGH | libvirt | A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control. | 2026-08-10 |
| CVE-2026-18938 |
6.2 (i)
| MEDIUM | p11-kit | A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems. | 2026-08-07 |
| CVE-2026-71227 |
5.1 (i)
| MEDIUM | libkcapi openshift_container_platform | A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive. | 2026-08-05 |
| CVE-2026-71226 |
7.3 (i)
| HIGH | libkcapi openshift_container_platform | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers. | 2026-08-05 |
| CVE-2026-71225 |
6.5 (i)
| MEDIUM | libkcapi openshift_container_platform | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing. | 2026-08-05 |
| CVE-2026-64564 |
7.8 (i)
| HIGH | kernel | In the Linux kernel, the following vulnerability has been resolved:sctp: don't free the ASCONF's own transport in DEL-IP processingsctp_process_asconf() caches the transport the ASCONF chunk is processedagainst in asconf->transport (== chunk->transport, set once in sctp_rcv()).For an ASCONF located through its Address Parameter by__sctp_rcv_asconf_lookup(), that cached transport corresponds to theAddress Parameter, which need not be the packet's source address.sctp_process_asconf_param() rejects a DEL-IP for the packet source address(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]where L differs from the source. The DEL-IP for L passes the D8 check andcalls sctp_assoc_rm_peer() on the transport that asconf->transport stillpoints at, freeing it (RCU-deferred). The following wildcard DEL-IP thenreuses the now-dangling asconf->transport in sctp_assoc_set_primary() andsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freedtransport (->ipaddr, ->state) and plants the dangling pointer intoasoc->peer.primary_path / active_path, and del_nonprimary_peers(), keepingonly the pointer that is no longer on the list, removes every realtransport, leaving the association with a transport_count of 0 andprimary_path/active_path pointing at freed memory.Reject a DEL-IP that targets the transport the ASCONF is being processedagainst, mirroring the existing source-address guard, so the wildcardbranch can never reuse a freed transport. | 2026-08-04 |