USN-8570-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

DEBIAN-CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

USN-8564-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. CVE-2026-12184 It was discovered that P...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

CVE-2026-64119

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP implementation. An unprivileged local user can exploit a vulnerability in the session unhashing mechanism by concurrently issuing session management commands. This can lead to an infinite loop, causing the host CPU to be...

EUVD-2026-45900

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service...

CVE-2026-16254

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service. Mitigation Limit image...

PT-2026-61584

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

CVE-2026-64025

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

EUVD-2026-45804

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64119 l2tp: use list_del_rcu in l2tp_session_unhash

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

CVE-2026-64053

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

CVE-2026-64053

The CVE-2026-64053 issue lies in the Linux kernel block layer: bio_integrity_copy_user() overwrites bip_vcnt, and bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Writing with nr_vecs can violate bip_vcnt