CVE-2026-89578

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

UBUNTU-CVE-2026-89578

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

CVE-2026-89578

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

EUVD-2026-76490

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

CVE-2026-89578 dm-io: clone the source bio instead of copying its biovec

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

EUVD-2026-76460

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

CVE-2026-89549 sunrpc: route to a populated pool in svc_pool_for_cpu()

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svcpoolforcpu svcsetnumthreads spreads the requested threads evenly across the service's pools base = nrservs / svnrpools. When a service runs fewer threads than it has pools -- e.g. an nfsd...

UBUNTU-CVE-2026-89329

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

CVE-2026-89329

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107264)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107264 advisory. In the Linux kernel, the following vulnerability has been resolved: md: Don't register syncthread for reshape directly Currently, if reshape is interrupted, then...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107262)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107262 advisory. In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore suspended array in mdcheckrecovery mddevsuspend never stop syncthread, hence it...

PT-2026-90049

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107275)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107275 advisory. In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown Hongyu reported a hang on kexec in a VM...

PT-2026-90265

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sunrpc component where connections can hang indefinitely. This occurs when a service, such as nfsd running in pernode or percpu mode, is configured with fewer...

PT-2026-96448

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc pool for cpu svc set num threads spreads the requested threads evenly across the service's pools base = nrservs / sv nrpools. When a service runs fewer threads than it has pools -- e.g. an...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022363 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and...

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

GHSA-JQHH-CJMQ-VMV6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

CVE-2026-80915

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added...