Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053213)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053213 advisory. In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kernmount fails and returns an...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053271)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053271 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in ipvsgetoutrt calls...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053422)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053422 advisory. In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntbregisterdevice If deviceregister fails in ntbregisterdevice, th...

CVE-2026-31912

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the...

OESA-2026-3627 perl-Net-DNS security update

Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions. Security Fixes: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR...

OESA-2026-3626 perl-Net-DNS security update

Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions. Security Fixes: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR...

SUSE CVE-2026-11465

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotel...

SUSE CVE-2026-80770

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hidhwstop on probe failure nintendohidprobe calls hiddeviceiostart before joyconinit and joyconledscreate. If either fails, the error path jumps to errclose which calls hidhwclose/hidhwstop...

SUSE CVE-2026-80907

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

GHSA-HWRM-C4CX-RF4J vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-85014

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

AZL-99470 CVE-2026-80911 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

CVE-2026-80911

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80911

CVE-2026-80911 affects the Linux kernel ASoC SOF (Sound Open Firmware) audio driver. The vulnerability resides in the error path of sof_widget_setup_unlocked() . When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, sof_widget_free_unlocked() is called twice, cau...

CVE-2026-80911 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

CVE-2026-80911

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...

EUVD-2026-71614

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...