CVE-2026-58093 Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-58093

The FreeBSD kernel contains a use-after-free vulnerability in the tty module's TIOCSCTTY ioctl handler. The issue stems from a race condition where the handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the lock. This allows a...

CVE-2026-58091

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

EUVD-2026-66236

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58091

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

CVE-2026-58091: Use After Free

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

PT-2026-81936

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

VulnCheck KEV: CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...

CVE-2026-58093: Concurrent Execution using Shared Resource with Improper Synchronization

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-58094: Time-of-check Time-of-use (TOCTOU) Race Condition

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

PT-2026-82200

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the s390/qeth component where the qeth snmp command and qeth l3 arp query functions allocate a buffer based on a user-supplied length udata len without verifying a low...

PT-2026-82094

Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an...

PT-2026-82158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the amdgpu dm crtc set vblank function. This happens when vblank is enabled or queried via the 'DRM IOCTL MODE CRTC GET SEQUENCE' endpoint before a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098930)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098930 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098701 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported...

Linux Distros Unpatched Vulnerability : CVE-2026-79619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host...

CVE-2026-79619: Incorrect Authorization

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104579)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104579 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the...

Linux Distros Unpatched Vulnerability : CVE-2026-80584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatale...