Linux Distros Unpatched Vulnerability : CVE-2026-90051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case,...

CVE-2026-93105

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

CVE-2026-93105 esp: do not unref managed frag pages in esp_ssg_unref()

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

CVE-2026-90051

CVE-2026-90051 affects the Linux kernel's TCP devmem (device memory) TX path . When NETIF_F_SG is absent, devmem TCP TX was not rejected even though it requires zero-copy; tcp_sendmsg_locked() would take the copy path and attempt to read from a dma-buf iovec, breaking invariants assumed by commit...

CVE-2026-90051 tcp: reject non zerocopy devmem tx

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

CVE-2026-93105: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. It calls skbpageunref on every frag page for an out-of-place transfor...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

DEBIAN-CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

DEBIAN-CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

CVE-2026-90010

CVE-2026-90010 affects the Linux kernel's scsi: bsg (block SCSI generic) subsystem. During io_uring completion , the code copied scmd->sense_len into the user response buffer without capping it to max_response_len. After a valid sense, the SCSI midlayer sets sense_len to the actual length (up ...

EUVD-2026-80618

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

EUVD-2026-80617

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

RHEL 9 : kernel (RHSA-2026:68100)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68100 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fanotify: fix false positive ...