RockyLinux 10 : sssd (RLSA-2026:41937)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41937 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd:...

AlmaLinux 10 : sssd (ALSA-2026:41937)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41937 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd:...

PT-2026-63378

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.6.0 through 1.25.1 Description A flaw exists where a replay of a wildcard rrset Resource Record Set can be briefly marked as DNSSEC secure based solely on RRSIG Resource Record Signature validation and stored in t...

PT-2026-63383

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description When the unwanted-reply-threshold is enabled and set to a value greater than zero, the software is susceptible to a cache clearing attack. A malicious actor controlling a delegation that...

PT-2026-63384

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.4.22 through 1.25.1 Description An issue exists where the secrecy of the randomized UDP source port, used to increase entropy in DNS transactions, is undermined when resolver load balancing policies depend on the...

PT-2026-63377

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.7.0 through 1.25.1 Description Insufficient validation of the RRSIG.Labels field and premature cache writes during RFC 8198 aggressive NSEC processing enable cache poisoning. An attacker controlling a single...

PT-2026-63417

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can respond ...

EUVD-2026-46361

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

CVE-2026-63875

A flaw was found in the Linux kernel, specifically within the arm64 architecture's Translation Lookaside Buffer TLB management. When a Page Middle Directory PMD table was unshared, the TLB flush operation did not correctly invalidate entries in the walk cache. This oversight could leave stale PMD...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract !tuxasse...

Exploit for CVE-2026-60137

How does this work at all !plotd...

CVE-2026-64031

A flaw was found in the Linux kernel's erofs filesystem. A race condition exists when processing unaligned compressed extents, which can cause a managed memory page folio to be incorrectly added to the page cache multiple times. This inconsistency in memory management could allow a local attacker...

SUSE CVE-2026-63922

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6parsetlv caches skbnetworkheaderskb in nh while walking IPv6 TLVs. ipv6desthao may call pskbexpandhead for a cloned skb, which can move the skb head and invalidate the cached...

SUSE CVE-2026-64006

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

SUSE CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

SUSE CVE-2026-64031

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

SUSE CVE-2026-64057

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afsgetlink The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afsreadsingle to prevent races between...

SUSE-SU-2026:22835-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions bsc1266290. - CVE-2025-39894: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm...

CLEANSTART-2026-FD44150 Security fixes for CVE-2026-39822, CVE-2026-42504, CVE-2026-42505 applied in versions: 1.26.8-r4, 1.26.8-r5

Multiple security vulnerabilities affect the kubernetes-dns-node-cache package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PK07483 Security fixes for CVE-2026-39822, CVE-2026-42504, CVE-2026-42505 applied in versions: 1.26.8-r4, 1.26.8-r5

Multiple security vulnerabilities affect the kubernetes-dns-node-cache package. These issues are resolved in later releases. See references for individual vulnerability details...