CVE-2026-90997

Keycloak deployments in stateless mode with MySQL or MariaDB are affected by a replay protection bypass caused by a mismatch in row-count semantics between the database driver and Keycloak's application logic. An attacker who intercepts single-use security artifacts—such as JWT client assertions ...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-93190

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Reject out-of-bounds PD cap count crostypecregisterpartnerpdos copies the partner PDOs from the EC TYPECSTATUS response into the fixed capsdesc.pdoPDOMAXOBJECTS array. memcpycapsdesc.pdo,...

DEBIAN-CVE-2026-93079

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...

CVE-2026-92478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

DEBIAN-CVE-2026-90273

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...

CVE-2026-93190 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Reject out-of-bounds PD cap count crostypecregisterpartnerpdos copies the partner PDOs from the EC TYPECSTATUS response into the fixed capsdesc.pdoPDOMAXOBJECTS array. memcpycapsdesc.pdo,...

CVE-2026-93190 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Reject out-of-bounds PD cap count crostypecregisterpartnerpdos copies the partner PDOs from the EC TYPECSTATUS response into the fixed capsdesc.pdoPDOMAXOBJECTS array. memcpycapsdesc.pdo,...

EUVD-2026-82099

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-92478 scsi: ufs: core: Validate connected lane counts

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-92987

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-90249: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-93155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

AZL-101481 CVE-2026-89936 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

DEBIAN-CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

DEBIAN-CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...