CVE-2026-73635

Apache Struts is vulnerable to an Allocation of resources without limits or throttling (CWE-770) issue. When no fixed locale is configured, the framework uses the locale from the incoming request for localized-text lookups. This allows an unauthenticated remote client to cause internal caches to ...

CVE-2026-73635 Apache Struts: Unbounded growth of localized-text caches driven by the request locale

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

AZL-96468 CVE-2026-74386 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72453

In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cacheops-populate callback, and if cache operations include an exit callback, the error code from...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

UBUNTU-CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

UBUNTU-CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

UBUNTU-CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

CVE-2026-74386

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

CVE-2026-72451

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

CVE-2026-72366

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

UBUNTU-CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

RLSA-2026:54654 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind security update

An update is available for bind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...