Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100703 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6thbh: reject oversized option lists struct ip6topts stores at most IP6TOPTSOPTSNR...

The vulnerability in the driver/block/ublk_drv.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/block/ublkdrv.c component of the Linux operating system is related to incorrect checking of the specified index, position, or offset in input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-73374

The $ internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

CVE-2026-75104: Improper Limitation of a Pathname to a Restricted Directory

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099764 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph...

SUSE CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

AZL-96186 CVE-2026-74457 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

UBUNTU-CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

UBUNTU-CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74466

The CVE-2026-74466 vulnerability concerns the Linux kernel’s s390/zcrypt path. A domain value is extracted from a CCA or EP11 ioctl struct and, under certain conditions (custom device node, administrative load), is used as an array index after bounds checking without a speculation barrier. This c...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

EUVD-2026-59659

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74457 can: peak_usb: add bounds check for USB channel index

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

EUVD-2026-59650

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74457

The CVE-2026-74457 entry describes a Linux kernel issue in the can: peak_usb driver where ctrl_idx is derived from rx->len (USB payload). The mask 0x0f allows 0–15, but usb_if->dev[] is only size 2, causing heap out-of-bounds read and kernel panic in IRQ context. The fix adds bounds checks ...