PT-2026-90413

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh want write for early-verified SETATTR in nfsd proc setattr The BOTH TIME SET branch calls fh verify early so setattr prepare can inspect the dentry. This causes nfsd setattr to skip fh want write, so notify change ru...

PT-2026-90144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...

PT-2026-90422

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CB OFFLOAD after the worker kthread completes. When the post-copy vfs fsync range or...

PT-2026-90067

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915 mcu get eeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

PT-2026-90372

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush decode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucke...

PT-2026-90331

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

PT-2026-90327

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs attr update meta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed size field before the name and...

PT-2026-90092

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache info cache segs init iterates cache info-n segs times indexing cache-segments, which is sized to the cache device geometry, and get seg id takes each segment id from the...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

PT-2026-90440

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc s fmt vid out sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt fwht, whose sizeimage mult is 3: coded w coded h 3 + sizeofstruct fwht cframe hdr...

PT-2026-90296

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf get stack get perf callchain returns a per-CPU perf callchain entry buffer and releases its recursion slot via put callchain entry before returning, so nothing keeps the entry reserved while bpf get...

PT-2026-90488

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the folio clear dirty for io call in extent write cache pages with a plain folio test dirty check. Besides...

Linux Distros Unpatched Vulnerability : CVE-2026-89157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern. CVE-2026-89157 Note that...

The vulnerability of the tree_count_words() function in the src/spellfile.c file of the Vim text editor allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the treecountwords function in the src/spellfile.c file of the Vim text editor is related to the operation of writing data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-89764

PCRE2 before 10.48, on 32-bit platforms, has a pcre2 compile 32 integer overflow and resultant out-of-bounds write...

PT-2026-90527

stb vorbis through 1.22 contains a heap buffer overflow in start decoder where the codebook multiplicands allocation size is truncated from size t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process...

PT-2026-90198

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

PT-2026-90110

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out of sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc connection and every store to one is a read-modify-write of the other two...

PT-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted key size in parse tag 3 packet parse tag 3 packet set encrypted key size from the Tag 3 packet body without bounding it against ECRYPTFS MAX KEY BYTES 64. When encrypted key size 64, decrypt...

PT-2026-90390

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4 ff encode layoutget The XDR buffer size calculation in nfsd4 ff encode layoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memor...