Security Bulletin: This Power System update is being released to address CVE-2026-18871

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory...

Security Bulletin: This Power System update is being released to address CVE-2026-16661

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over th...

Security Bulletin: This Power System update is being released to address CVE-2026-16707

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host...

Security Bulletin: This Power System update is being released to address CVE-2026-17414

Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure...

Security Bulletin: This Power System update is being released to address CVE-2026-17028

Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and...

Security Bulletin: This Power System update is being released to address CVE-2026-18821

Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and...

Security Bulletin: This Power System update is being released to address CVE-2026-17097

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL ...

Security Bulletin: This Power System update is being released to address CVE-2026-17091

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a...

CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72342

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules a...

CVE-2026-72343

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72343 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72343 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

EUVD-2026-59242

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...

CVE-2026-72343

Summary: Multiple sources report in the Linux kernel net/mlx5e HV VHCA stats path a zero-sized buffer allocation bug that can lead to a fault when stats are enabled. The root cause was calling kvzalloc(0) via mlx5e_hv_vhca_stats_create() before priv->stats_nch is populated, resulting in a ZERO...

CVE-2026-72342 net/mlx5e: Fix HV VHCA stats agent registration race

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules a...

CVE-2026-72342

The CVE-2026-72342 issue affects the Linux kernel’s net/mlx5e HV VHCA stats path. The race occurs in mlx5e_hv_vhca_stats_create() when publishing the stats agent via mlx5_hv_vhca_agent_create(): the agent is published and a delayed invalidation is scheduled before priv->stats_agent.agent and p...

SUSE CVE-2025-35973

Improper handling of values for some IntelR Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur...

PT-2026-72531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5e driver where a zero-sized buffer is allocated during the creation of HV VHCA stats. When mlx5e hv vhca stats create is called before mlx5e open, the...

CVE-2026-47243 affecting package kata-containers for versions less than 3.32.0.kata0-1

CVE-2026-47243 affecting package kata-containers for versions less than 3.32.0.kata0-1. A patched version of the package is available...