Vulnerability disclosures

Disclosures

Vulnerabilities we found and reported, with the CVE the vendor assigned. Every line below is stated no more strongly than the vendor states it, and links to the record it came from.

D/01Assigned CVEs

Linux · net/xfrm (IPsec)

CVE-2026-46116

IPsec state use-after-free in __xfrm_state_delete

Our role: Found, reported, patched and tested by ArkLink
Weakness: Use-after-free
CVE published: 28 May 2026
Score: CVSS 3.1 7.8 (Linux kernel CNA)
Impact: Kernel memory corruption (slab use-after-free write). The kernel CNA rates it reachable by an unprivileged local user through user namespaces
Fixed in: Mainline 7.1-rc3 and stable 7.0.7, 6.18.30, 6.12.88, 6.6.140, 6.1.176, 5.15.210, 5.10.261

Read our write-up →

CVE-2026-46116 ↗ · NIST NVD
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete ↗ · kernel.org
Patch thread on the netdev list ↗ · lore.kernel.org

Apple · XNU kernel

CVE-2026-43822

Kernel use-after-free

Our role: Credited by Apple
Weakness: Use-after-free
CVE published: 27 July 2026
Impact: An app may be able to cause unexpected system termination (Apple's wording)
Fixed in: iOS and iPadOS 26.6 and 18.7.10, macOS Tahoe 26.6, Sequoia 15.7.8, Sonoma 14.8.8, watchOS 26.6, tvOS 26.6, visionOS 26.6

About the security content of macOS Tahoe 26.6 ↗ · Apple
About the security content of iOS 26.6 and iPadOS 26.6 ↗ · Apple
CVE-2026-43822 ↗ · NIST NVD

Apple · XNU kernel

CVE-2026-43739

Kernel out-of-bounds write

Our role: Credited by Apple
Weakness: Out-of-bounds write
CVE published: 27 July 2026
Impact: An app may be able to cause unexpected system termination (Apple's wording)
Fixed in: iOS and iPadOS 26.6, macOS Tahoe 26.6, watchOS 26.6, tvOS 26.6, visionOS 26.6

About the security content of macOS Tahoe 26.6 ↗ · Apple
About the security content of iOS 26.6 and iPadOS 26.6 ↗ · Apple
CVE-2026-43739 ↗ · NIST NVD

Found something in your own stack? hello@arklink.co