K000163828: Linux kernel vulnerability CVE-2026-46125

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the...

K000163827: Linux kernel vulnerability CVE-2026-46124

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofsexportiget isofsfhtodentry and isofsfhtoparent pass an attacker- controlled block number ifid-block or ifid-parentblock from the NFS file...

DEBIAN-CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: xfs: bounds-check buffer log item's dirty bitmap

A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code...

kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial o...

kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

kernel: ALSA: seq: close a re-opened queue timer in the destructor

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

K000163826: Linux kernel vulnerabilities CVE-2026-46164 and CVE-2026-46165

Security Advisory Description CVE-2026-46164 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in createspaceinfosubgroup error path When kobjectinitandadd fails, the call chain is: createspaceinfosubgroup - btrfssysfsaddspaceinfotype - kobjectinitandadd -...

CVE-2026-98647

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the kernel. When loading a specially crafted BPF program that accesses a structure with an empty flexible array member, the verifier...

CVE-2026-98646

A flaw was found in the Linux kernel's TCP subsystem. A local user running Berkeley Packet Filter BPF programs can cause a Denial of Service DoS by crashing the system. This issue occurs when destroying a listening TCP socket with pending connection requests, mistakenly invoking a sleeping...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server (versions 2.0.0 through 2.6.0) is vulnerable to an authorization bypass when GatewayClient.url is enabled. The WebSocketChannelsHandler fails to call authorizer.is_authorized(...) for the execute action on the kernels resource, allowing a restricted authenticated user to open an up...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-98643

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This flaw can lead to information disclosure when a BPF socket operations program reads the round-trip time rttmin field during TCP connection handling. Because the kernel fails to verify the socket type before casting i...