Kernel

1. Overview A vulnerability exists in the Windows Reliable Multicast Transport Driver (rmcast.sys) that implements the Pragmatic General Multicast (PGM) protocol. When processing incoming ODATA packets for a Forward Error Correction (FEC) group, the driver’s PgmHandleNewData function can decrement a parity packet counter past zero, causing an unsigned byte to underflow from 0 to 255. This corrupted counter subsequently causes out-of-bounds memory access when the driver attempts FEC decoding with an impossibly large parity count. An unauthenticated remote attacker can send specially crafted PGM multicast packets to a system running a PGM receiver application, potentially achieving kernel-level code execution. Microsoft addressed this vulnerability in the July 2026 security update. ...

1. Overview A use-after-free vulnerability exists in the Linux kernel’s BPF netfilter link implementation. The bpf_nf_link_lops operations structure uses synchronous deallocation (.dealloc) instead of RCU-deferred freeing (.dealloc_deferred), allowing a use-after-free when concurrent hook enumeration via nfnetlink races with BPF link destruction. The UAF on the kmalloc-192 slab cache is exploitable for local privilege escalation through heap spray and function pointer hijacking. The Linux kernel community addressed this vulnerability in kernel version 7.0-rc5. ...