kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

UBUNTU-CVE-2022-4994

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulatorpioin Use emulatorpioin directly for fast PIO instead of bouncing through emulatorpioin now that emulatorpioin fills "val" when handling in-kernel PIO. vcpu-arch.pio.count is guaranteed to be...

CVE-2026-64391

A flaw was found in ksmbd, the in-kernel Server Message Block SMB daemon. This vulnerability allows a remote attacker to bypass security restrictions by incorrectly handling credentials for Alternate Data Streams ADS input/output I/O operations. Instead of using the credentials established when t...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

RHEL 8 : kernel (RHSA-2026:47869)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47869 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1...

RLSA-2026:45115 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: xfrm single-frag length not properly limited kernel: dm log: fix out-of-bounds write due to...

SUSE CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

SUSE CVE-2026-64460

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriovrestorevfrebarstate uses the VF Resizable BAR Control register to decide how many VF BARs to restore nbars and which VF BAR each iteration addresses baridx. baridx indexes...

CVE-2026-64529

Summary: CVE-2026-64529 exists in the Linux kernel and concerns the QAT driver. The vulnerability stems from a previously exposed character device (qat_adf_ctl) with IOCTLs used for device configuration, start/stop, status, and enumeration that were not part of public user-space API headers and h...

CVE-2026-64498

The CVE-2026-64498 issue affects the Linux kernel IIO subsystem (iio: buffer: hw-consumer). The root cause was a lifetime change for scan_mask: it moved to a separate bitmap allocation (buffer.scan_mask) but iio_hw_buf_release() remained unchanged, risking improper cleanup. The fix ensures the sc...

CVE-2026-64409

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork Every once in a while we see a hung btmtksdioflush task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. cancelworktimer+0x3f4/0x460...

CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

PT-2026-64552

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep dequeue vep alloc request wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vep dequeue without a valid UDC reference. Since vrequest-udc is never...

PT-2026-64713

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm iio trigger register tmp006 probe allocates the DRDY trigger with devm iio trigger alloc but registers it with plain iio trigger register. The driver has no .remove callback, so on module unload...

PT-2026-64538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the isofs component when handling Rock Ridge symbolic link SL records. The functions get symlink chunk and parse rock ridge inode internal process...

PT-2026-64760

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qat adf ctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any publi...

CVE-2026-64221

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to...

kernel: scsi: core: Wake up the error handler when final completions race against each other

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsidechostbusy and ordering problems in scsiehinchostfailed can cause the SCSI error handler to never wake up when command completions race against each other. This leaves...