PT-2026-72763

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the is vm area hugepages function. This occurs because the find vm area function can return NULL when the provided address is not a valid vmalloc are...

SUSE CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64582

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

UBUNTU-CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware

EUVD-2026-53267

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

Linux Distros Unpatched Vulnerability : CVE-2026-64573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is while idx length - sizeofstruct...

SUSE CVE-2026-64413

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

EUVD-2026-48957

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

SUSE CVE-2026-63955

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BUG if ininterrupt returns true. However, ininterrupt also reports true when BH are disabled. The bridge code can call...

Linux Distros Unpatched Vulnerability : CVE-2026-63955

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BU...

SUSE CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

CVE-2026-63955

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BUG if ininterrupt returns true. However, ininterrupt also reports true when BH are disabled. The bridge code can call...

CVE-2026-63955

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BUG if ininterrupt returns true. However, ininterrupt also reports true when BH are disabled. The bridge code can call...

EUVD-2026-45728

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BUG if ininterrupt returns true. However, ininterrupt also reports true when BH are disabled. The bridge code can call...