EUVD-2026-101040

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391

The Linux kernel contains a vulnerability in the drm/xe driver where the asynchronous dropping of a VM's runtime PM reference during teardown allows a device to autosuspend while stale page faults remain queued. When the page-fault worker attempts to acknowledge these faults, it calls guc_ct_send...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. CVE-2026-80274: Validating resolver can abort while...

SUSE-SU-2026:4657-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. - CVE-2026-80274: Validating resolver can abort whi...

CVE-2026-98391: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:4635-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4635-1 advisory. - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662:...

CVE-2026-98391

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

PT-2026-114370

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. CVE-2026-19666: Use-after-free in...

Oracle Linux 8 : bind9.16 (ELSA-2026-79113)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-79113 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. CVE-2026-80274: Validating resolver can abort while...

SUSE-SU-2026:4597-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. - CVE-2026-80274: Validating resolver can abort whi...

bind security update

32:9.11.36-16.16 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized negative cached records early CVE-2026-19667...

Oracle Linux 9 : bind9.18 (ELSA-2026-75578)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75578 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent memory leak on following HTTPS/SVCB RR CVE-2026-81563 - Preve...

Oracle Linux 9 : bind (ELSA-2026-75767)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75767 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

Astra Linux – Vulnerability in nghttp2

nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. Prior to version 1.68.1, the nghttp2 library would stop reading incoming data when the user-facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 was called by the application. These APIs...

Astra Linux – Vulnerability in bind9

In BIND 9.0.0 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of the Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record that...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jbd2: The assertion “jh-bfrozendata == NULL” failed when the journal was aborted. The following process will fail the assertion “jh-bfrozendata == NULL” in jbd2journaldirtymetadata: jbd2journalcommitTransaction; unlinkdir/a; jh-b...