PT-2026-98664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ltc428 clk provider setup function where the clk init data structure is not fully initialized. Specifically, the init.num parents member remains uninitialized, whi...

PT-2026-98753

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs module where the btrfs init new device function switches latest dev and potentially s bdev from the seed device to a new sprout device before the first...

PT-2026-98512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt init nic function fails to propagate error return values from bnxt init rx rings. When bnxt alloc one rx ring fails, the return value...

Important: Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation. Red Hat Update Infrastructure RHUI container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version...

PT-2026-97953

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 RSI attestation token initialization where a field-spanning write warning occurs. The challenge is passed through registers a1 through a8, but copying data t...

PT-2026-104916

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2 quota init checks for duplicate quota change IDs while holding qd lock and the quota hash bucket bitlock. That path used gfs2 qd search bucket, which takes a lockref reference via lockref...

PT-2026-98140

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gfs2 module where the gfs2 quota init function checks for duplicate quota change IDs while holding the qd lock and the quota hash bucket bitlock. This process...

PT-2026-98139

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gfs2 module where the qc++ iterator increment was located within the loop body of the gfs2 quota init function. This placement caused pointer advancement to be mix...

PT-2026-97936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the aml spisg clk init function where the clk init data structure is not fully initialized. While the function populates init.parent data, it leaves init.parent names...

PT-2026-97939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A circular locking dependency exists in the OCFS2 file system within the ocfs2 init acl function. The issue occurs between the &oi-ip xattr sem and &journal-j trans barrier locks. A...

PT-2026-104932

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota init qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2 quota init. This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot...

Oracle Linux 8 : postgresql:12 (ELSA-2026-69924)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69924 advisory. - Add backport of CVE-2025-8714 Orabug: 38667546 - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670...

PT-2026-104851

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive init ipis fails e.g. irq domain alloc irqs fails, the error path frees the global xive ipis array. However, xive smp probe previously ignored this failur...

PT-2026-97947

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the powerpc/xive component. When the xive init ipis function fails, such as during a failure in irq domain alloc irqs, the error path frees the global xi...

Linux Distros Unpatched Vulnerability : CVE-2026-97521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used...

SUSE CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

DEBIAN-CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

UBUNTU-CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

EUVD-2026-85343

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...