Microsoft Windows TCPIP.SYS IppQualifyAddresses Out-of-Bounds Read Vulnerability

Summary An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet IRP can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition...

Linux Distros Unpatched Vulnerability : CVE-2026-99215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing fr...

Linux Distros Unpatched Vulnerability : CVE-2026-99138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With...

UBUNTU-CVE-2026-99211

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

Oracle Linux 10 : kernel (ELSA-2026-85321)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-85321 advisory. - ipv4: validate checksumstart before completing checksum CKI Backport Bot RHEL-280590 CVE-2026-99999 - signal: Prevent exec race Phil Auld RHEL-2820...

CVE-2026-99187: Linux: In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events…

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99182: Linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds…

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99213: Linux: In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle…

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCPCLOSING as once-established Handle the TCPESTABLISHED - TCPCLOSING transition on OPRST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect shou...

CVE-2026-99211: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and…

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99191: Linux: In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in…

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr calipsoskbuffsetattr adjusts payloadlen by the length of the option it inserts or resizes: payload = ntohsip6hdr-payloadlen; ip6hdr-payloadlen = htonspayload + lendelta; GR...

CVE-2026-99190: Linux: In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in…

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple, gpiodsetarrayvalue returns abruptly, bypassing the freeing of possibly...

CVE-2026-99181: Linux: In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced…

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99180: Linux: In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period…

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99179: Linux: In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in…

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99175: Linux: In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector…

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

CVE-2026-99173: Linux: In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace…

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99216: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on…

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

CVE-2026-99203: Linux: In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer…

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

CVE-2026-99201: Linux: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace…

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99192: Linux: In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on completion to free the skb and credit BQL. ethersetup leaves...