Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100301 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset The kfdeventpageset function writes...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100519)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100519 advisory. In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack...

The vulnerability of the Linux operating system’s kernel, related to the lack of lock checking, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to the lack of lock checking. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

SUSE CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

SUSE CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

UBUNTU-CVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup ath12kmacdppeercleanup clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer-peerid. That is wrong: dppeer-peerid for an MLO peer...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74444

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

UBUNTU-CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...

CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74514

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

UBUNTU-CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74564

CVE-2026-74564 concerns Linux kernel netfilter xt_hashlimit, where the XT_HASHLIMIT_RATE_MATCH flag can cause uninitialized access to the burst field in the dsthash_ent union when two or more rules reference the same hashtable. A kernel fix updates the .checkentry path to require the RATE_MATCH m...

CVE-2026-74560 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xskdropskb for AFXDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole...

CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist fails, the error path frees fou while it is still reachable through...