DEBIAN-CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

AZL-100904 CVE-2026-89655 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

UBUNTU-CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

DEBIAN-CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

AZL-100383 CVE-2026-80932 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

UBUNTU-CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

EUVD-2026-76567

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-89655 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-89655

A use-after-free (UAF) vulnerability exists in the Linux kernel's Ceph file system component, specifically in the __kick_flushing_caps() function. The root cause is a race condition : the function iterates over ci->i_cap_flush_list using list_for_each_entry() but drops i_ceph_lock to send cap ...

CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

CVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80932 vsock/virtio: flush works in dependency order

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

EUVD-2026-76255

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80932

A use-after-free vulnerability in the Linux kernel's vsock/virtio component is triggered during virtio_vsock_remove(). The function flushes work items before freeing the virtio_vsock object, but the flush order ignores dependencies: send_pkt_work can queue rx_work after the remove path has alread...

PT-2026-90062

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Linux kernel within the virtio vsock implementation. The virtio vsock remove function stops virtqueues and flushes work items before freeing the...

PT-2026-90371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ceph component of the Linux kernel. The kick flushing caps function iterates through the ci-i cap flush list using list for each entry but releas...

CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603 Unconditionally do TLB flushing ahead of page scrubbing

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...