CVE-2026-98630

A flaw was found in the Linux kernel's fbnic network driver. When memory allocation for a payload page pool fails, the error cleanup routine incorrectly attempts to destroy an invalid error pointer instead of releasing the allocated header page pool. A local user able to trigger interface queue...

CVE-2026-98411

A flaw was found in the Linux kernel's power sequencing subsystem. When device registration encounters a naming failure, the error-handling path attempts to clean up data structures before they are initialized. This issue leads to an invalid pointer dereference, which can cause the kernel to cras...

CVE-2026-90130

A flaw was found in the vdpasim component of the Linux kernel. During the cleanup process after a worker creation failure, an invalid pointer is dereferenced. This improper error handling can lead to a general protection fault, resulting in a system crash and a Denial of Service DoS...

Security Bulletin: UPDATED security alert for multiple OpenSSL vulnerabilities impacting AIX. Updated On: Fri Oct 9 03:18:49 CDT 2026. Reason: Updated the iFix to include the previously missing OpenSSL 1.1 and 1.0.2 shared libraries.

Summary Vulnerabilities in OpenSSL could cause excessive memory consumption CVE-2026-54874, heap buffer overflow CVE-2026-63072, indefinite cache growth leading to denial of service CVE-2026-63074, invalid pointer dereference CVE-2026-63076, and authentication forgery CVE-2026-75803. OpenSSL is...

Rocky Linux 10.2 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2026_67154)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667154 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when...

CVE-2026-93263

A flaw was found in the Linux kernel's ESWIN clock driver. Due to uninitialized stack memory during clock registration, leftover data can cause the clock framework to dereference an invalid pointer. This issue can trigger a kernel crash during device initialization, resulting in a Denial of Servi...

SUSE CVE-2026-90165

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

Linux Distros Unpatched Vulnerability : CVE-2026-90165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = tru...

AZL-102138 CVE-2026-90165 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

DEBIAN-CVE-2026-90165

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90165

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

EUVD-2026-81758

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90165

CVE-2026-90165 is an invalid pointer dereference in the Linux kernel's ksmbd (SMB server) subsystem. The root cause is in ksmbd_launch_ksmbd_durable_scavenger(): when kthread_run() fails, server_conf.dh_task is set to an ERR_PTR() while durable_scavenger_running remains true . A subsequent call t...

SUSE-SU-2026:23788-1 Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712. - CVE-2026-14457: RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate bsc1274792. - CVE-2026-63072: Heap Buffer Overflow in CMS Key...

SUSE-SU-2026:23794-1 Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712. - CVE-2026-14457: RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate bsc1274792. - CVE-2026-63072: Heap Buffer Overflow in CMS Key...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

CVE-2026-80993

A flaw was found in the Linux kernel's net: phylink component. The phylinkinbandcaps function does not correctly validate the return value from macselectpcs, which can return an error pointer instead of a valid Physical Coding Sublayer PCS object. This oversight can lead to dereferencing an inval...

Linux Distros Unpatched Vulnerability : CVE-2026-88054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks bu...

CVE-2026-88054 Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1275145, bsc1274792. CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. CVE-2026-63076: invalid point...