RLSA-2026:61240 Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref CVE-2026-14324 pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 For more details about the security issues, including the impact, a CVSS score, acknowledgment...

RHEL 9 : pipewire (RHSA-2026:61240)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61240 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-104498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104498 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label wit...

Linux Distros Unpatched Vulnerability : CVE-2026-80646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

GHSA-9PWQ-GCRX-WGHH Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

SUSE CVE-2026-72092

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

SUSE CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

UBUNTU-CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

UBUNTU-CVE-2026-80636

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

CVE-2026-80701 drm/vmwgfx: enforce cursor size limits for MOB cursors

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80691 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80646 ipv6: guard against possible NULL deref in __in6_dev_stats_get()

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

EUVD-2026-67507

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

CVE-2026-80631

CVE-2026-80631 affects the Linux kernel's btrfs LZO decompression path (lzo_decompress_bio() in fs/btrfs/lzo.c). The root cause is an insufficient validation check: each on-disk segment length (seg_len) is validated only against the workspace buffer size, not against the actual compressed input s...

SUSE CVE-2026-72163

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...