CVE-2026-0004: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-0004 is a reserved CVE with limited official disclosure as of the time of this report. Feedly threat intelligence describes it as a quadratic runtime (ReDoS-style) denial-of-service vulnerability in the isGlob function of Deno's @std/path standard library, affecting versions prior to 1.1.2 (Feedly). However, Oracle Linux's CVE repository associates this identifier with a kernel-level vulnerability (kernel-uek) addressed in errata ELSA-2026-500587/500588/500590, with a preliminary CVSS v3.1 base score of 5.6 (Medium) and a local attack vector with high confidentiality impact (Oracle Linux). The CVE remains in Reserved status with no unified public advisory, making definitive attribution of scope and affected products uncertain at this time.

Based on Feedly intelligence, the vulnerability in Deno @std/path stems from algorithmic complexity issues (CWE-1333: Inefficient Regular Expression Complexity) in the isGlob function, where specially crafted input strings can trigger quadratic runtime behavior, exhausting CPU resources (Feedly). The Oracle Linux reference, by contrast, associates the CVE with a Linux kernel (UEK) flaw characterized by a local, high-complexity attack vector requiring low privileges, with a changed scope and high confidentiality impact — suggesting a possible information disclosure or privilege boundary issue in the kernel (Oracle Linux). Full technical write-ups and PoC code have not been publicly confirmed for either interpretation. The discrepancy between sources may reflect CNA assignment ambiguity or a multi-component vulnerability.

If the Deno @std/path interpretation is accurate, exploitation could cause denial-of-service conditions in applications relying on the isGlob function, degrading or halting service availability for affected Deno-based applications (Feedly). If the Oracle Linux kernel interpretation is accurate, the impact is more severe: a local attacker with low privileges could potentially read sensitive kernel memory or cross privilege boundaries, resulting in high confidentiality impact on Oracle Linux 9 systems running the UEK kernel (Oracle Linux). In either case, integrity and remote exploitation are not indicated by current data.

CVE-2026-0004 has not been observed being exploited in the wild, and no public proof-of-concept exploit code has been confirmed (Feedly). The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. EPSS score data is not yet available given the Reserved status of the CVE. The Oracle Linux errata were released on 2026-11-09, suggesting a patch is available for the kernel-related interpretation (Oracle Linux).

For Oracle Linux 9 systems running the UEK kernel, Oracle has released errata ELSA-2026-500587, ELSA-2026-500588, and ELSA-2026-500590 (released 2026-11-09), and administrators should apply these kernel updates promptly (Oracle Linux). For Deno-based applications using @std/path, upgrading to version 1.1.2 or later is recommended to address the isGlob quadratic runtime issue (Feedly). Until official advisories are published, organizations should monitor vendor channels for updated guidance and apply the principle of least privilege to limit exposure.

The CVE was noted in a Full Disclosure mailing list post in July 2026 and referenced in security briefing aggregators shortly after (seclists.org). No significant vendor statements, researcher commentary, or media coverage specific to this CVE have been identified beyond automated aggregation. Community discussion remains limited given the Reserved status and lack of a unified public advisory.