Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098731)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098731 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of...

GO-2026-6258 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CVE-2026-63075

The OpenSSL QUIC stack is vulnerable to a memory exhaustion Denial of Service (DoS) (CWE-770). When a remote peer completes a QUIC handshake and repeatedly sends ack-eliciting packets (such as PING frames ) while withholding acknowledgments for ACK-only responses , the OpenSSL implementation impr...

CVE-2026-74708

A flaw was found in the Linux kernel's xsk AFXDP socket component. This vulnerability arises from improper validation of launch-time metadata size, where the metadata can extend beyond its allocated structure. This could lead to inconsistent decisions if user space concurrently changes flags,...

The vulnerabilities of the functions lkkbd_connect() and lkkbd_disconnect() in the drivers/input/keyboard/lkkbd.c module of the Linux kernel keyboard driver allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions lkkbdconnect and lkkbddisconnect in the driver/input/keyboard/lkkbd.c module of the Linux kernel’s keyboard driver is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an...

The vulnerabilities of the functions l2cap_disconnect_req() and l2cap_disconnect_rsp() in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the functions l2capdisconnectreq and l2capdisconnectrsp in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem are related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting these vulnerabilities coul...

The vulnerabilities of the functions nilfs_palloc_get_block() (fs/nilfs2/alloc.c) and nilfs_load_inode_block() (fs/nilfs2/inode.c) in the NILFS2 file system of the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions nilfspallocgetblock fs/nilfs2/alloc.c and nilfsload inodeblock fs/nilfs2/inode.c in the NILFS2 file system of the Linux operating system is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerabilit...

The vulnerabilities in the functions gserial_disconnect() and gserial_resume() of the driver module drivers/usb/gadget/function/u_serial.c of the Linux operating system’s USB device drivers allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions gserialdisconnect and gserialresume in the driver module drivers/usb/gadget/function/userial.c of the Linux operating system’s USB device drivers is related to the pointer reallocation due to concurrent access to resources race condition. Exploiting this...

The vulnerabilities of the functions rb_free_cpu_buffer() and ring_buffer_free() in the kernel/trace/ring_buffer.c module, which support Linux operating system’s kernel tracing functionality, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions rbfreecpubuffer and ringbufferfree in the kernel/trace/ringbuffer.c module, which supports Linux operating system debugging, stems from the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow a...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

DEBIAN-CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

EUVD-2026-65155

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-45404

OpenTelemetry-Go versions 0.11.0 through 1.44.0 contain an unsynchronized extraBaggageItems map in the OpenTracing bridge's bridgeSpan. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can t...

CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-74647

A flaw was found in the Linux kernel's fastrpc component. This race condition occurs when multiple threads concurrently attempt to unmap a buffer. If the buffer is removed from the internal list after its unmap operation has started, it can lead to an inconsistent state. A local attacker could...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/setmemory: Avoid spinlock recursion in changepageattr The commit 1f9ad21c3b38 “powerpc/mm: Implement setmemory routines” included a spinlock call in changepageattr in order to safely perform the three-step operations...