CVE-2026-89486

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows a freed memory region to be accessed, which could be exploit...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2026-89762

A flaw was found in the Linux kernel's AppArmor security module. The begincurrentlabelcritsection function, used in various Linux Security Module LSM hooks, attempts to replace user credentials when a security label becomes stale. This process can lead to a Use-After-Free UAF vulnerability if the...

CVE-2026-89465

A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task can attempt to access memory that has already been...

CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2026-80928

A flaw was found in the Linux kernel's SMACK Simplified Mandatory Access Control Kernel security module. Incorrect handling of task credentials within the smackfilesendsigiotask function can lead to a Use-After-Free UAF vulnerability. A local attacker could exploit this flaw to potentially escala...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...

CVE-2026-80929

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the sysctl mechanism, specifically related to the cadpid entry. By unsharing process ID PID and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user...

CVE-2026-89750

A flaw was found in the Linux kernel's tracing/userevents component. This vulnerability arises when a child process, created via fork, exits and frees memory that the parent process still references. This creates a Use-After-Free UAF condition, where the parent process attempts to access freed...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-89761

A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing to specific system files, potentially leading to a denial...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90447

This ICS-CERT advisory (CSAF reference: ICSA-26-254-01) describes a privilege escalation vulnerability in a downstream service where a routing rule selects between two authentication mechanisms based on a client-supplied request header . An authenticated user possessing a shared service credentia...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-89513

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance Monitoring Unit PMU events during the SBI PMU EVENTGETINFO...

CVE-2026-89655

A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the kickflushingcaps function during the handling of capability messages. This allows a separate process to free a data structure cf entry while kickflushingcaps is still iterating over it. This...