Vulnerability intelligence

CVE-2026-15315 is an authentication bypass vulnerability found in TP-Link Tapo C120 v1 and C200 v5 smart cameras. This flaw exists within the login authentication verification module, specifically in the local HTTPS management interface operating on port 443. Researchers discovered that the camera's challenge-response authentication process could be circumvented by replaying a value the device originally returned during an authentication exchange. An attacker on the local network can exploit this weakness in challenge parameter validation to obtain valid administrative session tokens without needing to know or recover the user's password. Successful exploitation grants unauthorized administrative access, enabling the attacker to execute privileged management functions, modify device configurations, and potentially access privacy-sensitive features like live video streams and stored recordings. TP-Link addressed this vulnerability in firmware version V5_1.4.6, released on August 18, 2026.

CVE-2026-15316 is an improper input validation vulnerability found in the configuration service of the TP-Link Tapo C200 camera, specifically affecting versions prior to V5_1.4.6. This flaw allows an attacker to send oversized encrypted credential data to the device. Due to insufficient validation, these malformed inputs can trigger exception handling failures, causing the affected camera to crash or restart. The successful exploitation of CVE-2026-15316 can temporarily disrupt the camera's HTTPS management and monitoring functionality, leading to a denial-of-service (DoS) condition until the service recovers. TP-Link addressed this issue in firmware version V5_1.4.6, released on August 18, 2026.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.

CVE-2025-39682 is a vulnerability found in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw specifically affects the handling of zero-length records within the `rx_list` during the `recvmsg()` process. This issue arises from a corner case where an initial zero-length record, pulled from the `rx_list`, disrupts assumptions made by the `recvmsg()` logic regarding zero-copy decryption and transitions between record types. This mishandling can lead to memory corruption and a use-after-free condition within the kernel's TLS receive path. A local, authenticated user can exploit this vulnerability by crafting a specific TLS traffic pattern that leaves a zero-length record queued on the `rx_list`, subsequently triggering the vulnerable code path during a `recvmsg()` call.

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.