EUVD-2026-71413

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hidhwstop on probe failure nintendohidprobe calls hiddeviceiostart before joyconinit and joyconledscreate. If either fails, the error path jumps to errclose which calls hidhwclose/hidhwstop...

SUSE-SU-2026:23494-1 Security update for bzip2

This update for bzip2 fixes the following issue: - CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash bsc1266786...

SUSE-SU-2026:23627-1 Security update for bzip2

This update for bzip2 fixes the following issue: - CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash bsc1266786...

OPENSUSE-SU-2026:21762-1 Security update for bzip2

This update for bzip2 fixes the following issue: - CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash bsc1266786...

CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

Linux Distros Unpatched Vulnerability : CVE-2026-80904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls...

CVE-2026-85577: Improper Neutralization of Input During Web Page Generation

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

Linux Distros Unpatched Vulnerability : CVE-2026-80828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout whe...

Linux Distros Unpatched Vulnerability : CVE-2026-85024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error...

CVE-2026-85024: Uncaught Exception

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

Linux Distros Unpatched Vulnerability : CVE-2026-84966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly...

PT-2026-86202

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the ASoC SOF audio component within the sof widget setup unlocked function. If tplg ops-dai config or widget kcontrol setup fails during widget setup, the system doubl...

PT-2026-85795

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ring-buffer where small events on architectures with RB FORCE 8BYTE ALIGNMENT set to true report a data length 4 bytes larger than expected. This occurs because rb...

Linux Distros Unpatched Vulnerability : CVE-2026-84969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a...

PT-2026-91798

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp unpack cookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

PT-2026-85631

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmet fc alloc ls iodlist advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the...

PT-2026-85801

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra crypto component where the system fails to return an ENOMEM error value when the input buffer allocation fails within the tegra ccm do one req function...

The vulnerability of the `lowpan_iphc_mcast_ctx_addr_compress()` function in the `net/6lowpan/iphc.c` module, which is part of the networking functions in the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the lowpaniphcmcastctxaddrcompress function in the net/6lowpan/iphc.c module of the Linux kernel’s networking functions is related to a single-shift error. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerabilities of the functions __kvm_at_s12() and __kvm_find_s1_desc_level() in the module arch/arm64/kvm/at.c of the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions kvmats12 and kvmfinds1desclevel in the arch/arm64/kvm/at.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, an...

The vulnerability of the drm_gem_change_handle_ioctl() function in the drivers/gpu/drm/drm_gem.c module of the Linux kernel allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the drmgemchangehandleioctl function in the drivers/gpu/drm/drmgem.c module of the Linux kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibilit...