CVE-2026-80990

CVE-2026-80990 is a resource-leak bug in the Linux kernel Thunderbolt networking (tbnet ) subsystem. In tbnet_connected_work(), the function requests a specific Rx HopID from tb_xdomain_alloc_in_hopid(), which uses ida_alloc_range() with the desired ID as a lower bound. If the requested ID is alr...

CVE-2026-80990

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

CVE-2026-80963 dm-stats: fix a crash if allocation of per-cpu data fails

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963

CVE-2026-80963 affects the Linux kernel 's dm-stats module (device-mapper statistics). The root cause is a NULL pointer dereference in the dm_stat_free function: when the per-CPU allocation via dm_kvzalloc fails, execution jumps to an error path that calls dm_stat_free, which iterates over all po...

CVE-2026-80963 dm-stats: fix a crash if allocation of per-cpu data fails

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

EUVD-2026-76286

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

EUVD-2026-76269

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

Security Bulletin: Security Vulnerability identified in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-43871, CVE-2026-45112, CVE-2026-48586 )

Summary There is a vulnerability in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects...

CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code. Description: The SymSpellModelSerializer.create...

BIT-TOMCAT-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at...

BIT-PYTHON-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

PT-2026-90527

Name of the Vulnerable Software and Affected Versions stb vorbis versions prior to 1.23 Description A heap buffer overflow occurs in the start decoder function due to the truncation of the codebook multiplicands allocation size from size t to int. An attacker can exploit this by providing a...

PT-2026-90268

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the param set charp function where character pointer parameters are stored in allocated memory. When a parameter is updated, the previous value is released before the...

PT-2026-90330

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs cluster alloc function bounds its scan of the vol-lcn empty bits per page array by the size of the $Bitmap instead of the volume's clust...

PT-2026-90360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An extent map leak occurs during NOCOW direct I/O write operations. The function btrfs dio iomap begin invokes btrfs get extent, which generates an extent map reference that must be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107323 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we...

CVE-2026-89502: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpubuffer::freepage with subbuforder When sub-buffers use an order greater than 0, cpubuffer-freepage is allocated with subbuforder. Use the correct order for cpubuffer-freepage...

PT-2026-90225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the alloc and bind function within the ionic driver. This happens because the driver was not adapted to the requirements of rdma zalloc drv obj, whic...