Unity Linux 20.1070a Security Update: kernel (UTSA-2026-151315)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151315 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete Both nciclosedevice and ncirxwork can call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 “nfc: nci: fix circular locking dependency in...

SUSE CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

DEBIAN-CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

UBUNTU-CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

EUVD-2026-115269

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227

The Linux kernel contains a vulnerability in the io_uring/waitid component where the reference counter (bits 30:0 of ->refs) can wrap to zero due to repeated failed cancellation attempts. Specifically, __io_waitid_cancel() increments the reference field even if the cancellation returns false. ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout attempts to abort an async IOCB that has timed out. When qla24xxasyncabortcmd fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path...

CVE-2026-99227: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap…

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

Linux Distros Unpatched Vulnerability : CVE-2026-99227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: defin...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

EUVD-2026-107482

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

PT-2026-120775

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data ready work handler drivers/sensor/broadcom/afbr s50/afbr s50.c, a non-STATUS OK return from Argus EvaluateData calls handle error on result, which finalises the reques...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production, we have been encountering the following warning consistently: ------------ cut here ------------ refcountt: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:2...

CVE-2026-90224

A flaw was found in the Near Field Communication NFC Controller Interface NCI subsystem of the Linux kernel. A double completion race condition can occur when nciclosedevice and ncirxwork concurrently call ncidataexchangecomplete. This can lead to a use-after-free vulnerability, where a network...