UBUNTU-CVE-2026-46224

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xedmabufinitobj on allocation failure When drmgpuvmresvobjectalloc fails, the pre-allocated storage bo is not freed. Add xebofreestorage before returning the error. xedmabufinitobj calls xeboinitlocked, whi...

CVE-2026-46224 drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xedmabufinitobj on allocation failure When drmgpuvmresvobjectalloc fails, the pre-allocated storage bo is not freed. Add xebofreestorage before returning the error. xedmabufinitobj calls xeboinitlocked, whi...

CVE-2026-46224 drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xedmabufinitobj on allocation failure When drmgpuvmresvobjectalloc fails, the pre-allocated storage bo is not freed. Add xebofreestorage before returning the error. xedmabufinitobj calls xeboinitlocked, whi...

CVE-2026-46224

The CVE-2026-46224 issue affects the Linux kernel drm/xe driver. The bug is a lifecycle/ownership problem in xe_dma_buf_init_obj() where a pre-allocated storage bo is not freed when drm_gpuvm_resv_object_alloc() fails, leading to a potential resource leak. The kernel now ensures that, on failure,...

EUVD-2026-32779

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rxresult ieee80211invokefastrx is documented as safe for parallel RX, but its per-invocation rxresult is declared static. Concurrent callers then share one instance and can overwri...

CVE-2026-46149

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf return in tgptgpmembersshow targettgptgpmembersshow formats LUN paths with snprintf into a 256-byte stack buffer, then will memcpy curlen bytes from that buffer. snprintf returns the length...

EUVD-2026-32748

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link symlink within an exported filesystem Persistent Volume Claim PVC that points...

scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

...

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

...

de.adorsys.sts:keycloak-storage-provider (>=1.2.0, <=1.2.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (>=6.5, <=6.9) +23 more potentially affected by CVE-2026-9803 via org.keycloak:keycloak-services (25.0.2)

org.keycloak:keycloak-services MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.2.0, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5,...

com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17), com.charlyghislain.keycloak:keycloak-importexport (16.0.0) +30 more potentially affected by CVE-2026-9802 via org.keycloak:keycloak-services (16.1.0)

org.keycloak:keycloak-services MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.c4-soft.springaddons:keycloak-grants-mapper =3.1.13-jdk1.8, =1.3.17, =1.3.17, =1.3.17, =1.3.17...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9802 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +17 more potentially affected by CVE-2026-9803 via org.keycloak:keycloak-services (22.0.4)

org.keycloak:keycloak-services MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =0.14 -...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +17 more potentially affected by CVE-2026-9802 via org.keycloak:keycloak-services (22.0.4)

org.keycloak:keycloak-services MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =0.14 -...

org.keycloak:keycloak-dependencies-server-all (24.0.3), org.keycloak:keycloak-guides (24.0.3) +6 more potentially affected by CVE-2026-9801 via org.keycloak:keycloak-ldap-federation (24.0.3)

org.keycloak:keycloak-ldap-federation MAVEN version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 24.0.3 - org.keycloak:keycloak-guides...

Keycloak has Insufficient Session Expiration

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9794 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9798 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +17 more potentially affected by CVE-2026-9798 via org.keycloak:keycloak-services (22.0.4)

org.keycloak:keycloak-services MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =0.14 -...