kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

SUSE CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-86097: NULL Pointer Dereference

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in paramsetdefaultfile and paramsetbackupfile functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 she...

CVE-2026-75439: NULL Pointer Dereference

An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component...

PT-2026-91356

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcomm mutex for the deferred setup accept rfcomm sock recvmsg completes a deferred setup by calling rfcomm dlc accept without holding any RFCOMM lock: if test and clear bitRFCOMM DEFER SETUP, &d-flags...

RHEL 7 : kernel (RHSA-2026:63538)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63538 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

Linux Distros Unpatched Vulnerability : CVE-2026-80912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value t...

CVE-2026-80118: NULL Pointer Dereference

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handl...

PT-2026-85758

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

CVE-2026-17273: NULL Pointer Dereference

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

Linux Distros Unpatched Vulnerability : CVE-2026-80846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

PT-2026-91355

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input register device exposes the device to userspace immediately. In joycon input create it was called before joycon config rumble configures the FF RUMBLE capabili...

CVE-2026-80846: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

PT-2026-85654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the nvmet execute identify nslist function. This occurs when a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I...

CVE-2026-80817: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...

CVE-2026-80819: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

PT-2026-86204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SELinux component where the system fails to ensure every boolean value is defined. The p bools.nprim value is derived from the policy image regardless of the actua...

CVE-2026-80913: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...