PT-2026-24435

Name of the Vulnerable Software and Affected Versions KVM versions affected versions not specified Description An out-of-bounds write issue exists in the hyp alloc function within arch/arm64/kvm/hyp/nvhe/alloc.c. This is due to insufficient input validation. Successful exploitation could lead to...

Unbreakable Enterprise kernel security update

6.12.0-109.67.6 - net: tunnel: make skbvlaninetprepare return drop reasons Menglong Dong Orabug: 39027305 6.12.0-109.67.5 - uek-rpm: fixed specs to explicitly call python3 as set as a requirement Mark Nicholson Orabug: 38933158 - Revert 'net/rds: fix crash by expanding kref coverage to...

The vulnerability of the svm_vcpu_pre_run() function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the x86 kernel of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the svmvcpuprerun function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to insufficient checking of exception states. Exploiting this vulnerability could allow an attacker to compromise the...

kernel: x86/tdx: Fix "in-kernel MMIO" check

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...

CLSA-2026-1773047152 kernel: Fix of 21 CVEs

i40e: fix IRQ freeing in i40evsirequestirqmsix error path CVE-2025-39911 - media: rc: fix races with imondisconnect CVE-2025-39993 - VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify CVE-2025-38102 - partitions: mac: fix handling of bogus partition table CVE-2025-21772 - tracing:...

CLSA-2026-1773045484 kernel: Fix of 28 CVEs

fix: dm: fix dmblkreportzones CVE-2025-38141 - ice: Fix a null pointer dereference in icecopyandinitpkg CVE-2025-38664 - qed: Don't collect too many protection override GRC elements CVE-2025-39949 - drm/amd/display: Avoid a NULL pointer dereference CVE-2025-39693 - iommu/amd/pgtbl: Fix possible...

The vulnerability in the virtualization subsystem’s arch/x86/kvm/mmu.c module on the Linux operating system’s x86 kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the arch/x86/kvm/mmu.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1.8)

The version of AHV installed on the remote host is prior to 10.0.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0.1.8 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading ...

K000160227: Linux kernel vulnerability CVE-2025-37849

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvmarchvcpucreate fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data...

CVE-2024-47886

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution RCE within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an...

PT-2026-43949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the KVM SVM component, the INVLPGA instruction fails to trigger an invalid opcode exception UD when the EFER.SVME variable is not set. This occurs because the system does not properly...

PT-2026-43926

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the KVM nSVM component, an issue exists where the current RIP Instruction Pointer is incorrectly used as the NextRIP in vmcb02 after the first L2 VMRUN. For guests with NRIPS disabled...

Linux Distros Unpatched Vulnerability : CVE-2025-29939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in secure encrypted virtualization SEV could allow a privileged attacker to write to the reverse map page RMP during secure nested pagin...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005446 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: fix panic on out-of-bounds guest IRQ As guestirq is coming from KVMIRQFD API call, it m...

CVE-2026-0029

In pkvminitvm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0029

A logic error in the __pkvm_init_vm function within pkvm.c on Google Android can lead to memory corruption . This vulnerability allows for local escalation of privilege without requiring additional execution privileges or user interaction. While some sources suggest this is a mismanagement of pri...

CVE-2024-47886

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution RCE within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an...

CVE-2024-47886 Chamilo: Post-Auth Remote Code Execution

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution RCE within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an...

CVE-2024-47886 Chamilo: Post-Auth Remote Code Execution

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution RCE within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an...

CVE-2024-47886

CVE-2024-47886 affects Chamilo (LMS). A post-authentication phar unserialize bug in the virtualization plugin (vchamilo) allows an administrator to execute arbitrary code on the server, via features exposed by the plugin, in versions 1.11.12–1.11.26. The issue is mitigated by upgrading to version...