RHSA-2026:42825 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001461 advisory. In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6routempathnotify syzbot found another use-after-free in...

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

GHSA-9PWQ-GCRX-WGHH Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

EUVD-2026-42995

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...

EUVD-2026-43001

Snipe-IT's import createdby can be overwritten...

EUVD-2026-42991

Snipe-IT has an authorization bypass on bulk editing users...

EUVD-2026-44960

Yamcs: Insecure Direct Object Reference IDOR in PacketsApi allows unprivileged users to dump all telemetry packets...

RHSA-2026:59028 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:41176 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

CVE-2026-80718

In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpucreatechunk In pcpucreatechunk, nrpages is the total contiguous backing allocation, i.e., nrunits pcpuunitpages, but pcpuchunkpopulated uses it to set chunk-populated, whose...

CVE-2026-80715

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

CVE-2026-80677

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

CVE-2026-80665 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

CVE-2026-80656 hfsplus: Add a sanity check for btree node size

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80628 ALSA: seq: oss: Serialize readq reset state with q->lock

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q-lock sndseqossreadqclear resets qlen, head, and tail without q-lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset ca...

CVE-2026-80613 veth: fix NAPI leak in XDP enable error path

In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes. However, the rollback loop: for i--; i = start; i-- decrements the lo...