CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

CVE-2026-72076

Summary (CVE-2026-72076): In the Linux kernel driver for ims-pcu, a debugging print in ims_pcu_irq() could read beyond the buffer. When an interrupt was for pcu->urb_ctrl, the actual data lives in pcu->urb_ctrl_buf, but the code unconditionally printed from pcu->urb_in_buf. If urb->ac...

CVE-2026-72037

The CVE-2026-72037 entry affects the Linux kernel’s lan743x Ethernet subsystem. The root cause is a race in lan743x_hardware_init(): the adapter->eth_syslock_spinlock is used by lan743x_hs_syslock_acquire() before it is initialized, because strap status is read prior to spinlock initialization...

CVE-2026-72037 net: lan743x: Initialize eth_syslock spinlock before use

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

EUVD-2026-58995

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

CVE-2026-72005 wifi: rt2x00: avoid full teardown before work setup in probe

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

PT-2026-72226

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth syslock spinlock before use lan743x hardware init calls pci11x1x strap get status during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x hs syslock...

PT-2026-72340

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm tis spi: Use wait woken in wait for tmp stat wait event interruptible timeout evaluates its condition after setting the current task state to TASK INTERRUPTIBLE. With CONFIG DEBUG ATOMIC SLEEP this triggers a warning whe...

PT-2026-72265

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims pcu irq debug logging The debug logging in ims pcu irq unconditionally prints data from pcu-urb in buf. However, if the interrupt fired for pcu-urb ctrl, the actual data resides in...

Linux Distros Unpatched Vulnerability : CVE-2026-72152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tpm: tpmtisspi: Use waitwoken in waitfortmpstat waiteventinterruptibletimeout evaluates its condition after setting the current task state to TASKINTERRUPTIBLE...

PT-2026-72194

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib probe dev uses the full rt2x00lib remove dev teardown for all probe failures. However, drv data allocation and workqueue allocation can fail before intf work,...

PT-2026-72563

In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular -lock work It seems that initalising afs vnode::lock work a single time in the slab's init function isn't sufficient for work structs. This results in the DEBUG OBJECTS...

PT-2026-72279

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna drm sync bo ioctl looks up args-handle in the ioctl caller's drm file. For SYNC DIRECT FROM DEVICE, it then calls amdxdna hwctx sync debug bo, but passes abo-client...

Malicious code in debug-proxy-chrome-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c [email protected] declares a postinstall hook "postinstall": "node install.js" that automatically executes on npm install. install.js...

SUSE CVE-2026-68403

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

Linux Distros Unpatched Vulnerability : CVE-2026-68438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d smp: Improve...

Security Bulletin: IBM i is Affected By A Prvilege Escalation Vulnerability [CVE-2026-18509]

Summary IBM i is vulnerable to privilege escalation CVE-2026-18509 in Navigator and Debug Service as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18509 DESCRIPTION: IBM i could allow a local authenticated attacker to gain privilege escalation via the...

CVE-2026-17082 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name...

CVE-2026-17082

IBM i 7.3–7.6 (5770-SS1) contains CVE-2026-17082 in the Debug Server: remote authenticated attackers can gain elevated privileges due to improper validation of a client-supplied profile name. CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low attack complexity, and privileges require...

CVE-2026-17082 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name...