CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

UBUNTU-CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72279 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72279

The CVE-2026-72279 entry concerns the Linux kernel KVM arm64 implementation for the L1 VNCR mapping. The fix ensures that the host stage-1 mapping respects the read-only status of the guest PFN by caching PFN writability in the VNCR TLB and using this to constrain fixmap permissions. If a guest t...

EUVD-2026-59178

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72279 KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

EUVD-2026-58989

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

CVE-2026-72031

The CVE-2026-72031 entry concerns the Linux kernel (ata/libata-core) and a NOLPM quirk for the PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less). The vulnerability arises when Device-Initiated Slumber is entered during idle: under the default med_power_with_dipm policy the PCIe link drops (SStatus...

Linux Distros Unpatched Vulnerability : CVE-2026-72031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM- less drops off the bus after entering Device-Initiated...

PT-2026-72467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

PT-2026-73023

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the btrfs module when mounting with the rescue=ibadroots option after the block group tree root or the raid stripe tree root has been corrupted. This...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72812

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

PT-2026-71982

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A missing authorization issue exists in the '/api/ref/refreshBacklink' endpoint. This allows anonymous readers to trigger persistent server-side writes by invoking the endpoint with a controlled block...

CVE-2026-72679

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and...

EUVD-2026-58276

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to...

CVE-2026-72651

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to...

CVE-2026-72679 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and...