PT-2026-90433

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zram destroy comps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUG ON in zlib code due to missing winbits...

PT-2026-90122

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

PT-2026-90227

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add build skb...

PT-2026-90263

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svc create initializes three per-pool percpu counter stats and ignores every return value. On SMP, percpu counter init fails when alloc percpu gfp cannot satisfy the allocation,...

Linux Distros Unpatched Vulnerability : CVE-2026-45747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS...

PT-2026-90135

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration try smi init allocates new smi-si sm and later calls ipmi register smi mod, which maps to ipmi add smi. During ipmi add smi, the upper IPMI message handler obtains...

AlmaLinux 10 : gstreamer1-plugins-base (ALSA-2026:66460)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66460 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2026:3835-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3835-1 advisory. OpenSSL is updated to 3.5.0 in SLE-15-SP7: jscPED-16072 Enables Post-Quantum Cryptography PQC TLS support...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107326 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths When the HBA is...

Linux Distros Unpatched Vulnerability : CVE-2026-88054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks bu...

PT-2026-90222

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS ATTR UHW to UVERBS METHOD REG MR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with reg mr that cannot be passed through the ioctl. They also assume that the udat...

PT-2026-90225

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdma counter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdma counter using rdma zalloc drv obj" requires drivers implementing counter ops to embed struct rdma counter in...

PT-2026-90176

In the Linux kernel, the following vulnerability has been resolved: s390/cpum cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu cf events at first event...

PT-2026-90193

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp process strreset outreq, sctp process strreset addstrm out and sctp process strreset resp complete a pending stream reconfiguration request by stopping the reconf timer...

PT-2026-90427

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

PT-2026-90486

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs bio integrity alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs bio integrity free...

PT-2026-90412

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG NFSD V4 2 INTER SSC is enabled, nfsd4 putfh can return success with fh dentry and fh export both NULL if fh verify returns nfserr stale and putfh-no...

PT-2026-90286

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

PT-2026-90277

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6 rpl srh rcv ipv6 rpl srh rcv dereferences idev from in6 dev get without a NULL check when reading idev-cnf.rpl seg enabled. When the device's MTU drops below IPV6 MIN MTU, addrconf...

PT-2026-90307

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket ioctl submit job releases rjob through rocket job put on allocation error paths. rocket job cleanup unconditionally calls rocket iommu domain putjob-domain, but...