29839 matches found
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100344)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100344 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix memory leak from the atomicdestroystate callback After several commits, the...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099946)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099946 advisory. In the Linux kernel, the following vulnerability has been resolved: spi: bcm-qspi: return error if neither hifmspi nor mspi is available If neither a hifmspi nor msp...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100334)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100334 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfadimprobe function fails during initialization, the memory...
CVE-2026-74571
In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts BUG Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address:...
CVE-2026-74559
In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...
UBUNTU-CVE-2026-74557
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsiscsicmdrsp copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes,...
UBUNTU-CVE-2026-74564
In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...
CVE-2026-74466
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...
UBUNTU-CVE-2026-74539
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
UBUNTU-CVE-2026-74469
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...
CVE-2026-74577
In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...
CVE-2026-74568 KVM: arm64: vgic: Fix race between LPI release and re-registration
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...
CVE-2026-74556 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSIDEFMAXRECVSEGLEN 819...
CVE-2026-74527
CVE-2026-74527 affects the Linux kernel’s octeontx2-af pathway. PF and VF NIX LFs sharing a CGX LMAC can reuse the same hardware PKIND programming; when HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the PF’s LMAC RX PKIND or default TX parse config. The fix adds cgx_get_pkin...
CVE-2026-74503 ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...
CVE-2026-74490
CVE-2026-74490 affects the Linux kernel’s TIPC subsystem. According to multiple sources (NVD, SUSE, Debian, OSV, PT Security, EUVD), the issue is a use-after-free in the poll trace path where tipc_poll() can trigger queue dumps (tipc_list_dump) while an skb may be dequeued and freed in an unlocke...
CVE-2026-74490 tipc: avoid use-after-free in poll trace queue dumps
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...
EUVD-2026-59684
In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in ofpcirangeparserone The bus matching rework made ofmatchbus return NULL for nodes with ranges/dma-ranges but no local address-cells. parserinit stored that NULL bus, and the range iterator...
CVE-2026-74443
CVE-2026-74443 affects the Linux kernel DRM/vmwgfx path. The issue in vmw_cmd_dma() computes the DMA suffix location without ensuring header->size can contain both body and suffix, allowing an undersized header to underflow the suffix pointer and later overwrite verified fields of a relocated ...