Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014337)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014337 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: gadget: pxa27xudc: fix memory leak with using debugfslookup When calling debugfslookup the...

Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014352)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014352 advisory. In the Linux kernel, the following vulnerability has been resolved: mctp: fix use after free Clang static analysis reports this problem route.c:425:4: warning: Use ...

Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014328 advisory. In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: Add check for kstrdup Add check for the return value of kstrdup and return the erro...

Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014343)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014343 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: rtsxpci: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014326 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: sunplus: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

UBUNTU-CVE-2026-31680

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown ip6flseqshow walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl-opt-optnflen when an option block is present. Exclusive...

CVE-2026-31673

In the Linux kernel, the following vulnerability has been resolved: afunix: read UNIXDIAGVFS data under unixstatelock Exact UNIX diag lookups hold a reference to the socket, but not to u-path. Meanwhile, unixreleasesock clears u-path under unixstatelock and drops the path reference after unlockin...

CVE-2026-31683

The CVE-2026-31683 issue affects the Linux kernel’s batman-adv module. When the Optimized Global Messaging (OGM) aggregation state is toggled at runtime, a forwarded packet that was allocated with insufficient tailroom may be appended to by a later packet, leading to skb_put overflow conditions. ...

CVE-2026-31680 net: ipv6: flowlabel: defer exclusive option free until RCU teardown

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown ip6flseqshow walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl-opt-optnflen when an option block is present. Exclusive...

CVE-2026-31680

The CVE concerns a race in the Linux kernel IPv6 flow label handling. In ip6fl_seq_show(), the global flowlabel hash is read under an RCU read lock, and an option block’s state fl->opt->opt_nflen may be printed when present. The current lifetime of the option state can end with fl->users...

SUSE CVE-2026-31583

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free in em28xxv4l2open em28xxv4l2open reads dev-v4l2 without holding dev-lock, creating a race with em28xxv4l2init's error path and em28xxv4l2fini, both of which free the em28xxv4l2 struct and set...

SUSE CVE-2026-31590

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Drop WARN on large size for KVMMEMORYENCRYPTREGREGION Drop the WARN in sevpinmemory on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing: struct kvmencregion range =...

CVE-2026-31590

A flaw was found in the Linux kernel, specifically within the Kernel-based Virtual Machine KVM subsystem's Secure Encrypted Virtualization SEV feature. A local user could exploit this vulnerability by providing an excessively large memory region size when using the KVMMEMORYENCRYPTREGREGION...

CVE-2026-31546

A flaw was found in the Linux kernel's networking bonding driver. This vulnerability occurs when the bonddebugrlbhashshow function attempts to access a network interface that has been unassigned, leading to a NULL pointer dereference. A local attacker with appropriate permissions could exploit th...

DEBIAN-CVE-2026-31623

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: fix skb frags overflow in rxcomplete A malicious USB device claiming to be a CDC Phonet modem can overflow the skbsharedinfo-frags array by sending an unbounded sequence of full-page bulk transfers. Drop the...

DEBIAN-CVE-2026-31592

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Protect all of sevmemencregisterregion with kvm-lock Take and hold kvm-lock for before checking sevguest in sevmemencregisterregion, as sevguest isn't stable unless kvm-lock is held or KVM can guarantee KVMSEVINIT2 has...

DEBIAN-CVE-2026-31591

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being...

DEBIAN-CVE-2026-31549

In the Linux kernel, the following vulnerability has been resolved: i2c: cp2615: fix serial string NULL-deref at probe The cp2615 driver uses the USB device serial string as the i2c adapter name but does not make sure that the string exists. Verify that the device has a serial number before...

CVE-2026-31542

In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Handle deconfigured sockets When a socket is deconfigured, it's mapped to SOCKEMPTY 0xffff. This causes a panic while allocating UV hub info structures. Fix this by using NUMANONODE, allowing UV hub info structur...

CVE-2026-31645

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix page pool leak in error paths lan966xfdmarxalloc creates a page pool but does not destroy it if the subsequent fdmaalloccoherent call fails, leaking the pool. Similarly, lan966xfdmainit frees the coherent DMA...