CVE-2026-72154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...

CVE-2026-74425: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

CVE-2026-72366: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough...

PT-2026-72554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs create write req function where caching is skipped if the fscache cookie is disabled. This occurs because asynchronous cache object creation may not have...

CVE-2026-74573: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

PT-2026-72817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A circular reference issue exists in the host1x GPU driver. When a buffer object is pinned using the host1x bo pin function with a cache, the resulting mapping is stored in the cache for...

PT-2026-72427

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSR AMD64 SYSCFG SNP EN". Section 8.8 of the SNP spec says: Before invoking SNP INIT EX with...

PT-2026-72436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter flowtable when using IPIP tunnels with direct xmit, such as with a bridge device. The problem occurs because no dst entry is provided to verify the skb...

PT-2026-72342

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the OpenRISC architecture implementation regarding jump label SMP syncing. The system fails to properly invalidate instruction caches icaches on remote cores, which ca...

PT-2026-73028

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the slab memory allocator where cycles can form between kmalloc caches of different sizes when allocating obj exts arrays used for memory allocation profiling and memc...

PT-2026-73013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel within the nh rt cache flush function, which is inlined into rtm new nexthop. The problem occurs when nh rt cache flush traverses t...

PT-2026-72885

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

PT-2026-72639

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the xfrm input state cache insertion code. The system verifies the state validity before acquiring the global xfrm state lock, allowing a state to be terminate...

PT-2026-72592

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the TIPC UDP media bearer teardown process. The cleanup bearer function calls dst cache destroy on replicast caches before calling synchronize net,...

PT-2026-72822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the nvmet-tcp module. In the nvmet tcp alloc queue function, if a connection is closed during the allocation process for example, when nvmet tcp set queue sock...

CVE-2026-72239: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

CVE-2026-74386: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesock returns -ENOTCONN, the error handling jumps to outdestroysq and the...

Linux Distros Unpatched Vulnerability : CVE-2026-74386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-tcp: fix page fragment cache leak in error path In nvmettcpallocqueue, when a connection is closed during the allocation process e.g., nvmettcpsetqueuesoc...

Linux Distros Unpatched Vulnerability : CVE-2026-72366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix netfscreatewritereq to handle async cache object creation netfscreatewritereq will skip caching if the fscache cookie is disabled, but this is a...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...