CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646

CVE-2026-89646 is a leaked inode reference bug in the Ceph filesystem component of the Linux kernel. When a writeback is aborted during unmount (because ceph_inc_osd_stopping_blocker() fails), the ihold() taken by ceph_dirty_folio() is never released via writepages_finish(), so i_wrbuffer_ref nev...

CVE-2026-89618

CVE-2026-89618 affects the Linux kernel 's eventfs (event filesystem) subsystem. The root cause is that init_ei() does not initialize the eventfs_inode list heads (ei->children and ei->list). When eventfs_create_dir() fails due to memory pressure , it calls free_ei() before the lists are in...

CVE-2026-89572

CVE-2026-89572 affects the Linux kernel cpufreq: apple-soc driver. The root cause is an incorrect OPP (Operating Performance Points) table cleanup mechanism: apple_soc_cpufreq_init() adds OPP tables loaded from firmware, but some failure paths do not remove them, and the driver relies on dev_pm_o...

CVE-2026-89507

A race condition in the Linux kernel's RDMA/ucma subsystem affects the ucma_write_cm_event() function, which re-reads the ctx->file pointer four times without holding the handler lock. This allows ucma_migrate_id() to swap the pointer mid-sequence, leading to list corruption , a kernel BUG (cr...

CVE-2026-81015 platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amdpmcprobe registers the LPS0 s2idle handler with acpiregisterlps0dev and creates the driver's debugfs directory before calling amdstbs2dinit, which is the las...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rpm: python3-rpm-6.1.0-1.hum1 aarch64, x8664 rpm-6.1.0-1.hum1 aarch64, x8664 rpm-apidocs-6.1.0-1.hum1 noarch rpm-build-6.1.0-1.hum1 aarch64, x8664 rpm-build-libs-6.1.0-1.hum1 aarch64, x8664...

CVE-2026-53952

GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) are affected by a logic flaw that allows unauthenticated attackers to create a new administrator account . The root cause is a self-exclusion bug in the post-installation deletion logic for admin/setup.php, which fails to r...

EUVD-2026-76446

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2026-53952 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.73 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.73 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.8.2-0.1.hum1 aarch64, x8664 nodejs26-bin-26.8.2-0.1.hum1 noarch nodejs26-devel-26.8.2-0.1.hum1 aarch64, x8664 nodejs26-docs-26.8.2-0.1.hum1 noarch...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cups: cups-2.4.19-4.1.hum1 aarch64, x8664 cups-client-2.4.19-4.1.hum1 aarch64, x8664 cups-devel-2.4.19-4.1.hum1 aarch64, x8664 cups-filesystem-2.4.19-4.1.hum1 noarch cups-ipptool-2.4.19-4.1.hum1...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.27: golang1.27-1.27.1-0.1.hum1 aarch64, x8664 golang1.27-bin-1.27.1-0.1.hum1 aarch64, x8664 golang1.27-docs-1.27.1-0.1.hum1 noarch golang1.27-misc-1.27.1-0.1.hum1 noarch...

PT-2026-96445

In the Linux kernel, the following vulnerability has been resolved: mm/migrate device: clear stale mapping after freeing swapcache migrate device pages reads the folio mapping before calling folio free swap. When folio free swap succeeds, the folio is removed from the swap cache, but the saved...

Xen: Improper Handling of HVM Emulation Return Codes (XSA-510)

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG in Xen. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...