CVE-2026-63801

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipcaeaddecryptdone tipcaeaddecrypt goes straight from tipcbearerholdb to cryptoaeaddecryptreq without taking a reference on the netns, unlike the encrypt path. When cryptoaeaddecrypt is...

CVE-2026-63801

CVE-2026-63801 is a Linux kernel vulnerability in TIPC crypto path. The issue arises when tipc_aead_decrypt() offloads to asynchronous crypto code and does not take a reference on the per-netns object before calling crypto_aead_decrypt(), unlike the encrypt path. If the bearer's netns is torn dow...

PT-2026-61121

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto nx component where nx crypto ctx shash exit calls nx crypto ctx exit using an incorrect argument type. Specifically, crypto shash ctx provides a nx crypto c...

PT-2026-61147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the mac802154 llsec module, the functions llsec do encrypt unauth, llsec do encrypt auth, llsec do decrypt unauth, and llsec do decrypt auth perform in-place cryptographic...

Linux Distros Unpatched Vulnerability : CVE-2026-63801

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: fix slab-use-after-free Read in tipcaeaddecryptdone tipcaeaddecrypt goes straight from tipcbearerholdb to cryptoaeaddecryptreq without taking a reference...

PT-2026-61117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free read exists in the TIPC AEAD decrypt function. The tipc aead decrypt function fails to take a reference on the network namespace netns before calling crypto aead...

Linux Distros Unpatched Vulnerability : CVE-2026-63831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform...

Linux Distros Unpatched Vulnerability : CVE-2026-63805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: nx - fix nxcryptoctxexit argument nxcryptoctxshashexit calls nxcryptoctxexit with cryptoshashctx... but cryptoshashctx gives a nxcryptoctx , not a...

Oracle Linux 8 : container-tools:ol8 (ELSA-2026-38504)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38504 advisory. - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39829, CVE-2026-39830, CVE-2026-39832 cockpit-podman - rebuild for CVE-2025-68121 - update to th...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: CVE-2026-31771: Bluetooth: Ignore HCIERRORCANCELLEDBYHOST on adv set terminated event bsc1264145. CVE-2026-43038: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach...

CVE-2026-44435

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a...

CVE-2026-44435

CVE-2026-44435 : Quicly (QUIC protocol implementation used with H2O) contains an assertion failure that triggers a Denial of Service when the total number of valid handshake messages over a CRYPTO stream within a single packet number space exceeds 32KB. The issue is fixed by commit 937d0e9. Affec...

CVE-2026-44435

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a...

CVE-2026-44435 Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a...

CVE-2026-44435 Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues The following security issues were fixed: CVE-2026-31771: Bluetooth: hcievent: move wake reason storage into validated event handlers bsc1264145. CVE-2026-43038: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach...

MAL-2026-10666 Malicious code in crypto-hasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5162012006c5d2576c6f93540445f10185d44acfb5cef39764f7a2b45c45d205 [email protected] impersonates the hash-wasm library. Its main entrypoint dist/index.umd.js injects code into the WASM Interface update method so...

Malicious code in crypto-hasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5162012006c5d2576c6f93540445f10185d44acfb5cef39764f7a2b45c45d205 [email protected] impersonates the hash-wasm library. Its main entrypoint dist/index.umd.js injects code into the WASM Interface update method so...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...