CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

EUVD-2026-48971

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

SUSE CVE-2026-64210

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done...

SUSE CVE-2026-64211

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcustruct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet...

SUSE CVE-2026-64250

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit 9f3f3bdc6d9dac1 "MIPS: smp: report dying CPU to RCU in stopthiscpu". smpsendstop parks all secondary CPUs in stopthiscpu. And the function marks the...

SUSE CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

PT-2026-64756

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.18 Description An issue exists in the xfrm module where the xfrm policy fini function incorrectly calls synchronize rcu within the .exit handler of xfrm net ops. This violates the guidelines in include/net/net namespace....

PT-2026-64758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where the hyperv receive sub function processes VMBus packets without verifying the actual number of bytes written by the host into hv-recv bu...

PT-2026-64616

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the FSCTL DUPLICATE EXTENTS TO FILE control code passes the source file to vfs clone file range or vfs copy file range without verifying the SMB access mask of the...

PT-2026-64487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse module. The fuse ref folio function unlocks a request but fails to re-lock it before returning. This allows fuse chan abort to end the request,...

Linux Distros Unpatched Vulnerability : CVE-2026-16378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16378 Note that Nessus...

PT-2026-64573

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.0 Description An issue exists in the Linux kernel where sleepable BPF programs cannot properly access Longest Prefix Match LPM maps. The function trie lookup elem uses an annotation that only validates classi...

Linux Distros Unpatched Vulnerability : CVE-2026-64286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU flushhypvcpu copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu...

openSUSE 16 Security Update : perl (openSUSE-SU-2026:21411-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21411-1 advisory. - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376:...

Linux Distros Unpatched Vulnerability : CVE-2026-64248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in...

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes...

Linux Distros Unpatched Vulnerability : CVE-2026-64250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit...