RLSA-2026:55764 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset CVE-2026-43206 kernel: crypto: ccp -...

MAL-2026-14121 Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-2048)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2048 advisory. Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic...

MiracleLinux 8 : osbuild-composer-101.5-1.el8_10.ML.1 (AXSA:2026-1558:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1558:08 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

RockyLinux 8 : kernel-rt (RLSA-2026:55765)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55765 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

Linux Distros Unpatched Vulnerability : CVE-2026-74402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-74279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfull...

Linux Distros Unpatched Vulnerability : CVE-2026-74404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Fix snpfilterreservedmemregions off-by-one Sashiko notes: regarding the bounds check in snpfilterreservedmemregions called via walkiomemresdesc:...

Linux Distros Unpatched Vulnerability : CVE-2026-74403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: if snpallocfirmwarepages returns NULL under memory pressure, is it safe to pass ...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

CVE-2026-74888

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

ROOT-APP-NPM-CVE-2023-46233 CVE-2023-46233 in crypto-js - Patched by Root

Root has patched CVE-2023-46233 in the crypto-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-554041 AIKIDO-2026-554041 in crypto-js - Patched by Root

Root has patched AIKIDO-2026-554041 in the crypto-js package for Root:npm. Multiple fixed versions available...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a hacker to induce a system failure.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a hacker to induce a system failure.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to incorrect resource initialization. Exploiting this vulnerability could allow an attacker to cause a system failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100511)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100511 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099698 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100515 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the...

UBUNTU-CVE-2026-74578

In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...