CVE-2026-97929

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

EUVD-2026-86891

In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afsfsprobefileserver fetches the current endpoint state under server-fslock, but leaves oldalist as NULL. Consequently, afssetpeerappdata treats every address list...

CVE-2026-97583

The Linux kernel contains a slab-use-after-free vulnerability in the AFS (Andrew File System) component. The issue arises because afs_fs_probe_fileserver() fetches the current endpoint state but leaves old_alist as NULL . Consequently, afs_set_peer_appdata() fails to unbind peers removed from the...

CVE-2026-97583 afs: Clear stale peer app data after address list changes

In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afsfsprobefileserver fetches the current endpoint state under server-fslock, but leaves oldalist as NULL. Consequently, afssetpeerappdata treats every address list...

CVE-2026-97562

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CLEANSTART-2026-IG26427 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

PT-2026-98707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ld abs function models failed BPF LD ABS or BPF LD IND instructions in a subprogram as an implicit return with...

PT-2026-98721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf sys bpf and bpf sys close functions are not correctly marked as sleepable. The bpf sys bpf function executes the bpf2 syscall body, whi...

CVE-2026-98061: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

CVE-2026-98047: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

CVE-2026-98061

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

CVE-2026-98033: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...

PT-2026-98696

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where callback frame constructors initialize map-typed argument registers using mark reg known zero before restoring map ptr. This process clears the...

PT-2026-98710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the in rbtree lock required cb function only checks the innermost verifier frame. When bpf rbtree add invokes its comparator while holding the...

PT-2026-98724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where tail calls made directly from callback frames are not properly handled. When a tail call occurs from a non-zero frame, t...

CVE-2026-98036

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes special fields after obtaining an element from bpfmemcachealloc. The allocator can return a fresh, zeroed unit, or recycle one from its...

CVE-2026-98003

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommuinitpci to enableiommusvapic, which is called on...

Linux Distros Unpatched Vulnerability : CVE-2026-98036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes speci...

Linux Distros Unpatched Vulnerability : CVE-2026-57178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without...

Linux Distros Unpatched Vulnerability : CVE-2026-93211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered...