CVE-2026-81018

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: think-lmi: Free system certificate signatures

Multi-certificate support also allows the system authentication object to store ->signature and ->save_signature, which leak when the driver is removed. Free the signatures to avoid leaking memory.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5dcb5ef125907d09806509a9db8c6705041e0026, < 9c28adde051fe76a7754856d0a414ab89adcaa4d; >= 5dcb5ef125907d09806509a9db8c6705041e0026, < abbcc0354108cf47a6055b951182bf73520d0363; >= 5dcb5ef125907d09806509a9db8c6705041e0026, < abca989604f60fe29d7170431f819e28ec7d868a
LinuxLinux6.13

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-810197.4wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record.CVE-2026-810207.4wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. ACVE-2026-810215.3The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download patCVE-2026-810225.3The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code CVE-2026-810264.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment nCVE-2026-810278.5one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel eitherCVE-2026-810284.9ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directorCVE-2026-810298.1OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the caCVE-2026-810306.5Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/CVE-2026-810317.2IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in bCVE-2026-810329.8NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webserCVE-2026-810335.3Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend
CVE-2026-81018: Unscored | Vulnix