CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68094

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

SUSE-SU-2026:23061-1 Security update for sssd

This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807...

Linux Distros Unpatched Vulnerability : CVE-2026-68266

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv...

PT-2026-69489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the USB gadget RNDIS function where the rndis query response function fails to perform adequate length checks on the BufLength and BufOffset variables. This lack of...

Linux Distros Unpatched Vulnerability : CVE-2026-68156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshak...

The vulnerability of the smb_grant_oplock() function in the fs/smb/server/oplock.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the smbgrantoplock function in the fs/smb/server/oplock.c module of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the maybe_fork_scalars() function in the fs/smb/server/smb2pdu.c module of the Smb subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the maybeforkscalars function in the fs/smb/server/smb2pdu.c module of the Smb subsystem in the Linux operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to compromise t...

Linux Distros Unpatched Vulnerability : CVE-2026-68157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matchin...

Linux Distros Unpatched Vulnerability : CVE-2026-68403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. I...

Linux Distros Unpatched Vulnerability : CVE-2026-68137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour...

PT-2026-69544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the pep get sb function. The problem occurs because pep get sb does not account for the possibility that pskb may pull might relocate the socket buffer s...

PT-2026-69645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after unlock issue exists in the drm/amdgpu component. The vm pointer returned by the amdgpu vm get vm from pasid function is only valid while the lock is held. When xa unlock...

Fedora 43 : bird (2026-3521e54a27)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3521e54a27 advisory. BIRD 3.3.2 2026-07-30 - BGP: Fix stack buffer overflow in Flowspec NLRI decoder - BGP: Minor improvements in Flowspec parsing - BGP: Fix minor issues with se...

EulerOS 2.0 SP11 : xorg-x11-server (EulerOS-SA-2026-3164)

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows ...

CVE-2026-11742 Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...

EUVD-2026-54682

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

JLSEC-2026-1196 GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow...

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...