CVE-2026-99046 gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99038

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

PT-2026-121856

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer read waits for the HDMI I2C transaction to reach I2C TRANSACTION DONE, but it ignores both timeout and signal returns from wait for completion interruptible timeout. If...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-databind (crlsa-2026_85231)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202685231 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

MiracleLinux 9 : jackson-databind-2.21.6-1.el9_8.1 (AXSA:2026-2107:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2107:01 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference...

AlmaLinux 9 : jackson-databind (ALSA-2026:85231)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:85231 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

CVE-2026-93154

A flaw was found in the Linux kernel's RDMA/irdma component. This vulnerability allows a local user to deregister Memory Regions MRs that are actively backing Queue Pair QP, Completion Queue CQ, and Shared Receive Queue SRQ rings. By doing so, a malicious user could potentially disrupt network...

environment-modules security update

An update is available for environment-modules. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The environment-modules packages provide dynamic modification of...

RLSA-2026:84594 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

jackson-databind security update

An update is available for jackson-databind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The general-purpose data-binding functionality and tree-model for...

RLSA-2026:85231 Important: jackson-databind security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind:...

Linux Distros Unpatched Vulnerability : CVE-2026-98690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on...

RockyLinux 9 : jackson-databind (RLSA-2026:85231)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:85231 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

Important: Red Hat Security Advisory: jackson-databind security update

An update for jackson-databind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

CVE-2026-106014 Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...

CVE-2026-106014

The Gateway for Vantiv on WC WordPress plugin, affecting versions through 1.0.1 , contains a vulnerability where it fails to verify the authenticity of payment notifications received via its hosted-payment return handler . This lack of validation allows unauthenticated attackers to perform a paym...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Moderate: Red Hat Security Advisory: environment-modules security update

An update for environment-modules is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...