PT-2026-72375

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid self-deadlock during inode eviction An attribute-list update performed while allocating clusters can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode...

CVE-2026-72244: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

PT-2026-72359

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtd: slram component where the register device function links a new slram mtdlist entry before all required state is allocated. If a subsequent allocation, memrema...

Linux Distros Unpatched Vulnerability : CVE-2026-72202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free- cluster readahead state getnrfreeclusters allocates a...

Linux Distros Unpatched Vulnerability : CVE-2026-72496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and...

Linux Distros Unpatched Vulnerability : CVE-2026-74526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: mpi3mr: Fix potential deadlock in mpi3mrfaultueventemit mpi3mrfaultueventemit runs from the fault watchdog and reset paths where host I/O may already be...

Linux Distros Unpatched Vulnerability : CVE-2026-72495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per uconte...

Linux Distros Unpatched Vulnerability : CVE-2026-74576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b mm/slab: avoid allocating slabobjext array from its own slab avoided...

Linux Distros Unpatched Vulnerability : CVE-2026-72252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some field...

Linux Distros Unpatched Vulnerability : CVE-2026-74542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix folioqueue ENOMEM in writeback by adding a mempool Fix the handling of folioqueue allocation failure in writeback by adding a mempool and passing in...

Linux Distros Unpatched Vulnerability : CVE-2026-74442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver...

Linux Distros Unpatched Vulnerability : CVE-2026-72485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and agai...

PT-2026-72531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5e driver where a zero-sized buffer is allocated during the creation of HV VHCA stats. When mlx5e hv vhca stats create is called before mlx5e open, the...

Linux Distros Unpatched Vulnerability : CVE-2026-74417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up...

SUSE CVE-2026-56860

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

SUSE CVE-2026-63299

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

SUSE CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

EUVD-2026-36103

s2n-quic has excessive memory allocation...

GHSA-9Q54-F358-3FQF s2n-quic has excessive memory allocation

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a singl...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JSON plugin when handling JSON request bodies. An attacker can cause excessive memory consumption by sending a large JSON payload, potentially leading to service disruption for...