PT-2026-97943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Improper exception masking in the arm64 hibernate code can lead to system crashes or warnings during the resume process. When a hibernation image is saved via swsusp arch suspend, all DA...

PT-2026-97944

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fs-integrity component of the block layer where the system fails to properly check BIP CHECK flags before generating or verifying Protection Information PI. This...

PT-2026-97945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 module where the make bad inode function is used within ocfs2 read inode block full. Because make bad inode resets the inode type to S IFREG, applying this t...

CVE-2026-93814

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

PT-2026-104987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers...

Linux Distros Unpatched Vulnerability : CVE-2026-93820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurren...

PT-2026-97795

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The prefetch library contains an out-of-bounds issue that can lead to a system crash when the software parses specifically crafted malformed prefetch files. Recommendations At the moment...

Linux Distros Unpatched Vulnerability : CVE-2026-97411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ibm: emac: mal: fix potential system hang in malremove napidisable is not idempotent and calling it on an already-disabled or unenabled NAPI context will...

SUSE CVE-2026-92162

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

SUSE CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

SUSE CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

kernel: Linux kernel: libceph null pointer dereference leads to denial of service

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service DoS...

kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update

A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-77414

A flaw was found in JSONata, a JSON query and transformation language. This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the host process. By crafting malicious JSONata expressions, an attacker can bypass a security check, gaining unauthorized access to...

CVE-2026-84724

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

EUVD-2026-85616

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The issue occurs because the system-job template launch endpoint fails to perform integer validation on a user-supplied "days" variable . Consequently, the dispatcher flattens the mana...