RHCOS 4 : OpenShift Container Platform 4.13.71 (RHSA-2026:65838)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65838 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - github.com/cri-o/cri-o: F...

AZL-103073 CVE-2026-81869 affecting package cri-o 1.30.1-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability...

DEBIAN-CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

AZL-101523 CVE-2026-89834 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834

CVE-2026-89834 affects the f2fs filesystem in the Linux kernel. In free_segment_range(), the curseg evacuation loop only iterated up to NR_CURSEG_PERSIST_TYPE (0–5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC . Although these types are n...

EUVD-2026-80434

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the JWK.importkey method, whose keyops duplicate detection rescans the whole array for every element and enforces no size limit, making the check On^2 over untrusted parsed JWK data. An attacker can...

CVE-2026-89834: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...

PT-2026-93475

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem within the free segment range function. The curseg evacuation loop only iterates up to NR CURSEG PERSIST TYPE, which fails to include non-persisten...

CVE-2026-92091: Inefficient Algorithmic Complexity

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...

Linux Distros Unpatched Vulnerability : CVE-2026-89834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5,...

PT-2026-93336

Name of the Vulnerable Software and Affected Versions jwcrypto affected versions not specified Description A flaw exists in the JWK.import key function regarding how it validates the key ops member of a JSON Web Key JWK. The validation process uses an algorithm with On^2 time complexity, and ther...

AZL-103079 CVE-2025-11395 affecting package cri-o 1.30.1-1

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

Multiple vulnerabilities in Lite-On O-RU "FF-RFI079I4" and "FF-RFI078I4"

Overview O-RU "FF-RFI079I4" and "FF-RFI078I4" provided by LITE-ON Technology Corporation contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-77853 Hidden Functionality CWE-912 - CVE-2026-80217 Yuto Aono, Yutaro Osako, and Shunsuke Saruwatari of The University of...

kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()

A flaw was found in the Linux kernel's block input/output control group blk-cgroup component. This vulnerability, a Use-After-Free UAF, occurs when multiple block control groups are released at the same time. A race condition allows one group to remove another's entries while it is still in use,...

CVE-2026-15923 Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

The Zephyr SDIO subsystem function sdioiorwextendedhelper in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MINremaining, func-cis.maxblksize as the per-iteration step. The value func-cis.maxblksize is decoded directly from the SDIO card's CIS FUNCE tuple in sdiodecodec...