PT-2026-64686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB xHCI driver where the xhci free streams function is called to free stream resources when a USB device with active stream endpoints is disconnected. The functio...

SUSE CVE-2026-63986

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...

SUSE CVE-2026-64153

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

CVE-2026-64094

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced component, specifically within its Bridge Loop Avoidance BLA feature. This vulnerability occurs when a network interface is unexpectedly removed while the system attempts to send an Address...

CVE-2026-64205

Summary: CVE-2026-64205 affects the Linux kernel i2c-i801 driver, where an unconditional hardware register cleanup in the error path could corrupt the SMBus hardware state machine during concurrent fuzzing, causing livelock and a Hung Task panic. Root cause: on i801_check_pre() failure (e.g., -EB...

CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

Malicious Package

Overview Reothor.Lab.EvilPackage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @gocortexio/npmgremlinbox-ucl-1-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-64173

Technical details for CVE-2026-64173 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-64153

In the Linux kernel drm/msm area, CVE-2026-64153 covers a fix for iommu_map_sgtable() return value handling. The underlying issue arose after a patch changed iommu_map_sg_atomic to return a signed size (ssize_t) and to emit negative values on error, instead of using size_t with zero. Consequently...

CVE-2026-64153 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

CVE-2026-63984 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

EUVD-2026-45747

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-64153: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

Malicious Package

Overview slds-lsp-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nodepack-daemon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview evm-typechain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview chai-chain-dom is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Parser Observer for Safe DNG SDK Input Validation / Runtime Monitoring

This C++ utility provides a minimal parser-observation framework for examining how the Adobe DNG SDK handles DNG file inputs while minimizing direct interaction with deeper image-processing stages...

Malicious Package

Overview peptideenv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...