CVE-2026-49419

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-49419 Jail reference count underflow

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-49423: Use of Uninitialized Resource

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

CVE-2026-72334

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream handling. A remote attacker, by sending specially crafted malformed Bluetooth ISO packets, could trigger a kernel panic, leading to a denial of service. Additionally, this vulnerability could result in a memory leak within th...

SUSE CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

SUSE CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-72206

A flaw was found in the Linux kernel's NTFS filesystem driver. Insufficient validation of index block headers within INDX blocks could allow a local attacker to craft a malicious NTFS filesystem image. When this image is processed by the kernel, it could lead to a kernel panic due to an...

CVE-2026-72191

A flaw was found in the Linux kernel's ntfs3 driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS filesystem image. This can lead to an integer underflow during a memory copy operation, resulting in an out-of-bounds kernel write. Successful exploitation...

CVE-2026-72162

A flaw was found in ocfs2, a component of the Linux kernel. On-disk corruption of an inode's embedded extent list can lead to an array-index-out-of-bounds error. This occurs when the lnextfreerec value is zero or exceeds lcount during a write operation to the affected file. A local attacker with...

CVE-2026-72150

A flaw was found in the Linux kernel's sunrpc component. The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. This can lead to critical fields containing uninitialized stack garbage. Exploiting this vulnerability can result in a kernel...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102137 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc ha...

Linux Distros Unpatched Vulnerability : CVE-2026-72036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call...

Linux Distros Unpatched Vulnerability : CVE-2026-72194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS...

Linux Distros Unpatched Vulnerability : CVE-2026-72163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the...

Linux Distros Unpatched Vulnerability : CVE-2026-72343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is...

Linux Distros Unpatched Vulnerability : CVE-2026-68463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with...

Linux Distros Unpatched Vulnerability : CVE-2026-72280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to...

Linux Distros Unpatched Vulnerability : CVE-2026-72008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101987)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101987 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with dropprogress and zero droplevel BUG When recovering relocation at...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102111)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102111 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT when the fs flips RO inside btrfsrepairiofailure BUG There is a bug report...