PT-2026-97809

Name of the Vulnerable Software and Affected Versions IBM PowerVM Hypervisor versions FW1120.00 through FW1120.01 IBM PowerVM Hypervisor versions FW1110.00 through FW1110.31 IBM PowerVM Hypervisor versions FW1060.00 through FW1060.81 IBM PowerVM Hypervisor versions FW950.00 through FW950.H3...

PT-2026-104881

In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: mal: fix potential system hang in mal remove napi disable is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPI STATE SCH...

PT-2026-98045

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential system hang occurs during module removal in the IBM EMAC MAL driver. The mal remove function calls napi disable unconditionally. Because napi disable is not idempotent, calli...

PT-2026-98125

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference can occur in the crypto: ixp4xx component. The chainup buffers function, which creates a linked list of buffer descriptors for a scatterlist, fails to handle...

PT-2026-104987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers...

CVE-2026-93820

In the Linux kernel, the following vulnerability has been resolved: PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

CVE-2026-93820: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

Linux Distros Unpatched Vulnerability : CVE-2026-93821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: altera: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-93819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: mediatek: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurren...

Linux Distros Unpatched Vulnerability : CVE-2026-97498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evict...

Linux Distros Unpatched Vulnerability : CVE-2026-93814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system...

CVE-2026-18857: Out-of-bounds Read

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to...

SUSE CVE-2026-92162

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

SUSE CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

SUSE CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update

A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...

kernel: Linux kernel: libceph null pointer dereference leads to denial of service

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service DoS...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-77414

A flaw was found in JSONata, a JSON query and transformation language. This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the host process. By crafting malicious JSONata expressions, an attacker can bypass a security check, gaining unauthorized access to...