Linux Distros Unpatched Vulnerability : CVE-2026-89628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its...

Linux Distros Unpatched Vulnerability : CVE-2026-89483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges...

Linux Distros Unpatched Vulnerability : CVE-2026-89616

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts...

CVE-2026-89702

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When processing NFSv2/v3-over-UDP requests, the nfsdfhverify and nfsdfhverifyerr tracepoints incorrectly size a memory buffer. This can lead to an out-of-bounds write, potentially allowing a remote attacker to cause a denial ...

CVE-2026-89478

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to read from freed memory, potentially causing a denial of...

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

CVE-2026-11748

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:28+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75 2026-09-12 04:32:07+00:00| seen| https://gist.github.com/alon710/c05d2b733514467507b538dab5375550...

CVE-2026-56828

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:14+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3...

CVE-2026-56829

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:09+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f...

CVE-2026-80931

A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, leading to an out-of-bounds read of up to 222 bytes. This...

CVE-2026-90460

creationtimestamp| type| source ---|---|--- 2026-09-11 21:50:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3aweqrn5ditaf 2026-09-12 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mvc3nml2g724 2026-09-12 03:00:28+00:00| seen|...

CVE-2026-89481

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...

CVE-2026-80961

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker with CAPSYSADMIN capabilities could exploit unbounded fields decoded from the cache device. This could lead to an out-of-bounds read, potentially disclosing sensitive information from adjacent persistent memory to...

UBUNTU-CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

AZL-100637 CVE-2026-89674 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

AZL-100667 CVE-2026-89650 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...