CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64260

CVE-2026-64260 affects the Linux kernel’s fuse-uring path. The issue concerns races on the queue->stopped flag: several readers check the value under a lock, but fuse_uring_commit_fetch() (and in fuse_uring_abort_end_requests() as noted) did not, meaning the flag could be observed/modified wit...

CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

EUVD-2026-48970

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

Libssh: libssh: denial of service via sftp responses with unknown request ids

...

SUSE CVE-2026-64240

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f "media: rc: igorplugusb: heed coherency rules" changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA...

PT-2026-64663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Out-of-bounds reads occur in the rtl8723bs staging driver due to missing header bounds checks in two Information Element IE parsing loops. Specifically, the functions issue assocreq and...

PT-2026-64483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fuse-uring component where the fuse uring send in task function fails to properly discharge the ring entry's reference to the fuse req when io uring delivers task...

PT-2026-64647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the io uring/nop component when handling file references. The issue arises when a NOP request is submitted with the IOSQE FIXED FILE flag set but without the IORI...

Linux Distros Unpatched Vulnerability : CVE-2026-64509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after...

PT-2026-64556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the digi acceleport USB serial driver where the read USB Request Block URB—a data structure used to manage USB transfers—is not resubmitted if the port is closed while...

PT-2026-64479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference issue exists in the fuse-uring component. When a copy into the userspace ring buffer fails, the fuse uring req end function sets ent-fuse req to NULL but leaves the...

PT-2026-64489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA siw driver where the siw proc rresp function fails to check the running total of inbound Read Response DDP segments against the sink buffer length on...

PT-2026-64633

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter ebtables component, module names are not properly validated to ensure they are null-terminated. This lack of length checking can result in a non-null terminated string...

Linux Distros Unpatched Vulnerability : CVE-2026-64442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference...

Linux Distros Unpatched Vulnerability : CVE-2026-66338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC...

PT-2026-64558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb mtu3 component where the mtu3 gadget queue function maps a request before verifying if the QMU GPD ring can accept another transfer. If the mtu3 prepare transf...

PT-2026-64628

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the nxp recv fw req v3 function during v3 firmware downloads. The issue occurs because the function only verifies the lower bound of the offset provided i...