Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146843)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146843 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146848)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146848 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces...

UBUNTU-CVE-2026-99174

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

UBUNTU-CVE-2026-99190

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple, gpiodsetarrayvalue returns abruptly, bypassing the freeing of possibly...

PT-2026-128196

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description A slab-use-after-free issue exists in the pipe fasync notifications. The problem occurs when fasync helper fails to allocate a writer entry after updating a reader entry for an O RDWR FIFO. I...

PT-2026-128206

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP CLOSING as once-established Handle the TCP ESTABLISHED - TCP CLOSING transition on OP RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect...

PT-2026-128209

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.20 Linux kernel versions prior to 5.5 Description In the VMBus driver, the system fails to properly reset the connection state during error or exit paths. Specifically, the vmbus connection.conn state is forced...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

PT-2026-128096

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker pool in node activate pending pwq: BUG: KASAN: slab-use-after-free in raw spin trylock+0x6d/0x120 Read of size 4 at addr...

PT-2026-128129

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.29 Linux kernel versions prior to 5.10.273 Description A race condition exists in the dm-crypt module within the crypt dec pending function. The issue occurs because the function reads the io-error variable...

PT-2026-128113

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...

PT-2026-128182

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc update irq chained handler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in tha...

PT-2026-128190

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx eth probe connects the PHY before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock since the commit ...

PT-2026-128181

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMAC RGSMIIIS, so RGSMIIIS stays pending behind GMAC INT...

Apple iOS / iPadOS 17.0.2 Kernel Privilege Escalation

Apple iOS and iPadOS versions before 16.7.1 and versions 17.0 through 17.0.2 contain a kernel issue that may allow a local attacker to elevate privileges. The included proof of concept attempts to demonstrate a copy-on-write bypass using Mach memory mappings. https://packetstorm.news/download/238...

PT-2026-128334

The GPIO syscall handlers in drivers/gpio/gpio handlers.c did not validate the pin argument supplied by a user-mode caller. z vrfy gpio pin configure, z vrfy gpio pin get config and z vrfy gpio pin interrupt configure verified only the device object K SYSCALL DRIVER GPIO / K SYSCALL OBJ and then...

CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

CVE-2026-99161

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmti2cprobe In wmti2cprobe, i2c-clk is acquired using ofclkget. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clkput, leadi...

CVE-2026-99111

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and OTRUNC cifsdotruncate flushes dirty pages with filemapwriteandwait and truncates the file on the server, but in the old code both operations ran without holding irwsem o...

CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...