Oracle Linux 9 : kernel (ELSA-2026-57252)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57252 advisory. - smb: client: validate DFS referral PathConsumed CKI Backport Bot RHEL-237668 CVE-2026-68343 - posix-cpu-timers: Prevent UAF caused by non-leader exe...

Oracle Linux 8 : kernel (ELSA-2026-55764)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55764 advisory. - udf: fix partition descriptor append bookkeeping Ravi Singh RHEL-179571 CVE-2026-45991 - ice: fix double-free of txbuf skb Michal Schmidt RHEL-19219...

RockyLinux 8 : kernel (RLSA-2026:57253)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57253 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

Oracle Linux 10 : kernel (ELSA-2026-57251)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57251 advisory. - udf: fix partition descriptor append bookkeeping CKI Backport Bot RHEL-179570 CVE-2026-45991 - crypto: pcrypt - Fix handling of MAYBACKLOG requests...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102050)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102050 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/vmwpvrdma: Fix double free on pvrdmaallocucontext error path Sashiko points out that...

CVE-2026-74434

A flaw was found in the Linux kernel's rxrpc subsystem. When an out-of-band OOB message is read using the MSGPEEK flag in the rxrpcrecvmsgoob function, the message is incorrectly left on one queue while also being added to another. This can lead to the message being freed twice when the socket is...

CVE-2026-74428

A flaw was found in the Linux kernel's rxrpc subsystem. A double unlock vulnerability in the rxrpcrecvmsg function, when processing out-of-band OOB messages, could allow a remote attacker to cause a system crash. This issue leads to a Denial of Service DoS condition...

CVE-2026-74398

A flaw was found in the Linux kernel's IPv6 address configuration addrconf component. A race condition can occur during the Duplicate Address Detection DAD failure handling. When addrconfdadfailure temporarily releases a lock, a concurrent ipv6deladdr operation can modify the network interface...

CVE-2026-77587

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

CVE-2026-77587

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

EUVD-2026-63593

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

CVE-2026-77587

Tor before 0.4.9.11 is affected by a use-after-free (and potential double free) in the conflux subsystem. The flaw occurs when a recovery leg revives a conflux set whose last linked leg has already been closed, allowing a malicious exit node to crash a client, resulting in a denial of service (TR...

CVE-2026-77587

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

CVE-2026-77587

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-74284

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve HFSC queueing discipline schhfsc. When a child qdisc drops its last packets, the updatevf function can be called twice for the same class, causing it to be marked passive multiple times. This double transition can lead to a...

CVE-2026-63652

A flaw was found in FreeRDP. An authenticated Remote Desktop Protocol RDP client can send a specially crafted Client Audio Formats Protocol Data Unit PDU to the server. This malformed PDU can cause a double-free vulnerability in the rdpsndserverrecvformats function, leading to the server reliably...

CVE-2026-64972 Reflected XSS in ATutor

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...

CVE-2026-74269

A flaw was found in the bnxt driver, a component of the Linux kernel responsible for network card operations. This vulnerability involves a memory corruption issue that occurs during specific network data processing XDP head-grow operations. An underflow in the driver's code can lead to incorrect...

OESA-2026-3479 libssh2 security update

libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS22, SECSH-USERAUTH25, SECSH-CONNECTION23, SECSH-ARCH20, SECSH-FILEXFER06, SECSH-DHGEX04, and SECSH-NUMBERS10. Security Fixes: libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds he...