CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-92920

admin3 (a Java-based admin framework) through 3.0.0 fails to invalidate existing sessions when a user account is disabled. The root cause lies in the AuthInterceptor , which never re-validates a user's locked status, and the LocalSessionManager , which resets session expiry on each request. As a ...

CVE-2026-93086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

CVE-2026-89775

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for arm64 systems. This issue arises when the system's Memory Management Unit MMU is inactive, causing an internal calculation for memory translation buffers TLB to misinterpret a negative value. This leads to an incorrect...

SUSE CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89918

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

DEBIAN-CVE-2026-89914

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

DEBIAN-CVE-2026-89916

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

CVE-2026-89916

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

DEBIAN-CVE-2026-89918

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

DEBIAN-CVE-2026-89836

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

EUVD-2026-80518

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89918

CVE-2026-89918 affects the Linux kernel KVM arm64 subsystem. The root cause is a flaw in the TLB invalidation (TLBI) by virtual address range: when the TLBI instruction's range reaches the end of the TTBR1 VA space , the expression base + size wraps around to 0, causing the range comparison to fa...

CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89915

This vulnerability affects the Linux kernel's KVM arm64 subsystem, where a flawed VM-wide VNCR mapping counter is used to decide whether an L1-provided VNCR page is mapped in L0 during TLB invalidation. The counter can result in missed TLB invalidations , and fails when an L1 vCPU invalidates its...

CVE-2026-89915 KVM: arm64: Remove VM-wide VNCR mapping counter

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

EUVD-2026-80515

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

EUVD-2026-80516

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...