CVE-2026-90098

CVE-2026-90098 affects the Linux kernel sparx5 network driver. The root cause is that sparx5_set_rx_mode() executes with netif_addr_lock_bh held (an atomic context), yet calls sparx5_mact_learn() / sparx5_mact_forget() , which acquire a mutex and poll the MAC access command register via readx_pol...

CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

EUVD-2026-81955

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-90094

CVE-2026-90094 affects the Linux kernel on arm64 systems, specifically in the process context-switching path for MTE (Memory Tagging Extension) store-only tag check mode. When a user opts in to store-only tag check via SCTLR_EL1.TCSO0 , that flag was not included in SCTLR_USER_MASK , meaning it w...

CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

Use of Incorrectly-Resolved Name or Reference

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the allowlist process. An attacker can execute unauthorized code in the host context by requiring a...

Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

GHSA-6FVH-FGMG-3X7V Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

GHSA-GG6F-MHQM-F7GP Duplicate Advisory: Sandbox Escape (NodeVM)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88hf-g992-jg85. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92951

vm2 prior to version 3.11.7 is affected by an incorrect authorization flaw in its external package allowlist mechanism. The root cause is the use of non-exact substring matching instead of full package-name boundary validation, allowing an attacker to require a colliding package name that merely ...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92951: Use of Incorrectly-Resolved Name or Reference

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-90098: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

PT-2026-105488

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

CVE-2026-90094: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

PT-2026-94442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture regarding the Memory Tagging Extension MTE store-only tag check mode. When a user opts into this mode, the SCTLR EL1.TCSO0 bit is set. Because...

PT-2026-94446

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sparx5 driver where the sparx5 set rx mode function operates while holding the netif addr lock bh lock. During this process, it calls sparx5 mc sync or sparx5 mc...