CVE-2026-15466

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466

A vulnerability exists in the GPU DDK where a non-privileged user can make improper GPU system calls to trigger a race condition in the hardware performance counters buffer's destruction path. This issue is caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM(), specifically leadi...

EUVD-2026-113474

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

SUSE CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-98668

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. This vulnerability allows information disclosure when the kernel processes unaligned data buffers with timestamps enabled. Because the allocated buffer is not properly cleared before being shared with user space, a local user ca...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability that stems from the lack of strict validation for the length of the SEG6ATTRDST attribute. This allows shorter payloads, resulting in out-of-bound reads of 16-byte segments of uninitialized kernel heap memory. This vulnerability can be exploited throu...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ibmasm: Fixed OOB reads in commandfilewrite due to missing size checks. The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it. However, it does not validate the buffer against...

SUSE CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

DEBIAN-CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

AZL-106221 CVE-2026-98236 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

UBUNTU-CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-98236 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

EUVD-2026-93164

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-98236 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...