Linux Distros Unpatched Vulnerability : CVE-2026-90430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmd...

Linux Distros Unpatched Vulnerability : CVE-2026-90206

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's...

openSUSE 16: libmbedcrypto7 / libmbedcrypto7-x86-64-v3 / libmbedtls14 / etc (openSUSE-SU-2026:21864-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21864-1 advisory. Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs...

Linux Distros Unpatched Vulnerability : CVE-2026-90264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device...

Linux Distros Unpatched Vulnerability : CVE-2026-93041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in th...

Linux Distros Unpatched Vulnerability : CVE-2026-90326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcgactivatepolicy allocates blkgpolicyda...

ROS-20260918-73-0076

The vulnerability in the net/mptcp/pmkernel.c component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0007

The vulnerability of the mtkmdpprobe function in the drivers/media/platform/mediatek/mdp/mtkmdpcore.c file of the Linux kernel’s multimedia device driver is related to unsynchronized access to shared data in a multi-threaded context. Exploiting this vulnerability could allow an attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-93380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social...

PT-2026-95636

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A race condition exists during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory wit...

PT-2026-95577

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.7 Description A race condition exists in the service downgrade implementation within the doUpgrade function of app/Livewire/Services/Upgrade.php. The application uses Service::upgradable to check for pending...

PT-2026-95580

Name of the Vulnerable Software and Affected Versions SysReptor Professional versions prior to 2026.61 Description Authenticated users can upload image files that trigger Ghostscript during processing, allowing embedded PostScript to operate within the shared temporary directory. By combining thi...

PT-2026-95635

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A timing issue, known as a symlink race condition, exists during privileged file operations such as changing file ownership or permissions. A local attacker can manipulate directory...

CVE-2026-91203: Race Condition Enabling Link Following

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

CVE-2026-91205: Race Condition Enabling Link Following

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

CVE-2026-81180: Improper Input Validation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

Linux Distros Unpatched Vulnerability : CVE-2026-90371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct...

Linux Distros Unpatched Vulnerability : CVE-2026-93123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded i...

Linux Distros Unpatched Vulnerability : CVE-2026-90189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk...

Linux Distros Unpatched Vulnerability : CVE-2026-90367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking...