CVE-2026-93809 drm/amdgpu: flush pending RCU callbacks on module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

CVE-2026-93809 drm/amdgpu: flush pending RCU callbacks on module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

kernel: ALSA: timer: drain a slave's callback before its master detaches it

A flaw was found in the ALSA Advanced Linux Sound Architecture timer component of the Linux kernel. When a master timer instance is closed, it does not properly ensure that all associated slave timer callbacks have finished executing before detaching them. This oversight can lead to a...

CVE-2026-97499

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

PT-2026-98118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the coresight component during device registration and unregistration. ETM perf callbacks rely on the per-CPU csdev src pointer, which can lead to inconsistent...

PT-2026-98009

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where pending RCU callbacks are not flushed during module unload. This can lead to a page fault if call rcu callbacks are executed after the...

PT-2026-97964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where destroy callbacks zero the udata output after driver resources are torn down. If userspace access fails, uverbs preserves the uobject...

CVE-2026-96600

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

EUVD-2026-85341

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

PT-2026-97346

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600: Improper Neutralization of Special Elements used in an SQL Command

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...

PT-2026-95752

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.3 Description Insufficient restriction of PHP functions used as custom field-validation callbacks allows users with form management privileges to trigger the...

SUSE CVE-2026-93109

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

AZL-102198 CVE-2026-93200 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...

DEBIAN-CVE-2026-93108

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108

CVE-2026-93108 affects the Linux kernel 's RDMA/ipoib subsystem. During module teardown, RCU callbacks may still be executing when ib_ipoib is unloaded, because IPoIB reclamation completions can be signaled from inside an RCU callback. Additionally, a client registration failure can remove alread...