MGASA-2026-0273 Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

CVE-2026-64205 i2c: i801: fix hardware state machine corruption in error path

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

CVE-2026-64205

Summary: CVE-2026-64205 affects the Linux kernel i2c-i801 driver, where an unconditional hardware register cleanup in the error path could corrupt the SMBus hardware state machine during concurrent fuzzing, causing livelock and a Hung Task panic. Root cause: on i801_check_pre() failure (e.g., -EB...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

CVE-2026-64058

A flaw was found in the Linux kernel's network file system netfs component. The netfsreadfolio function fails to wait for ongoing writeback operations to complete. This can lead to the system incorrectly trusting the dirty flag and prematurely cleaning up private data associated with a folio,...

NFSD: Fix SECINFO_NO_NAME decode error cleanup

...

Linux Distros Unpatched Vulnerability : CVE-2026-64033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created an...

Linux Distros Unpatched Vulnerability : CVE-2026-63839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint...

Linux Distros Unpatched Vulnerability : CVE-2026-64023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: aggregator: fix a potential use-after-free On error we free aggr-lookups-devid before removing the entry from the lookup table. If a concurrent thread cal...

Linux Distros Unpatched Vulnerability : CVE-2026-64035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializ...

Linux Distros Unpatched Vulnerability : CVE-2026-64115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: er...

Linux Distros Unpatched Vulnerability : CVE-2026-63861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache CVE-2026-31402 In the Linux kernel, the following vulnerability has been resolved: ext4: validate pidx bounds in ext4extcorrectindexes CVE-2026-31449 In the Lin...

SUSE CVE-2026-63798

In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers using...

CVE-2026-64163

In the Linux kernel, the following vulnerability has been resolved: testkprobes: clear kprobes between test runs Running the kprobes sanity tests twice makes all tests fail and eventually crashes the kernel. root@martin-riscv-1 echo 1 /sys/kernel/debug/kunit/kprobestest/run ... Totals: pass:5...

CVE-2026-64154

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

CVE-2026-64146

In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 "erofs: use meta buffers for xattr operations" converted xattr operations to use on-stack erofsbuf instances. erofsinitinodexattrs uses such a metabuf whil...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64059

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...