Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146817 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpidsterminatecontrolmethod Fix use-after-free issue in...

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place...

CVE-2026-99115: Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the clie...

CVE-2026-99127: Linux: In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized…

In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem rounds the requested fragment size with size = ALIGNsize, dmagetcachealignment; dmagetcachealignment returns 1 unless the architecture defines...

CVE-2026-99117: Linux: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group…

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown brmulticastdisableportctx and brmulticastdelport walk port-mglist with hlistforeachentrysafe. However, brmulticastfinddelpg can also delete other entries from the...

CVE-2026-99101: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its…

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146631)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146631 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array...

PT-2026-128111

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check mul overflow before calculating the firmware payload size. Reject zero-length payloads and zero...

Oracle Linux 9 : kernel (ELSA-2026-90365)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-90365 advisory. - netfilter: flowtable: hold reference on ct until flow is released CKI Backport Bot RHEL-280075 CVE-2026-98320 - vfio/pci: clear vdev-msiperm after...

AlmaLinux 10 : kernel (ALSA-2026:91565)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:91565 advisory. kernel: tcp: restrict SOATTACHFILTER to priv users CVE-2026-53236 kernel: fuse: re-lock request before replacing page cache folio CVE-2026-53388 kernel:...

Fedora 43 : kernel (2026-bdde82ac9e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bdde82ac9e advisory. The 7.2.13 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

CVE-2026-99121

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass...

CVE-2026-99202

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99179: Linux: In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in…

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99207: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding…

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

PT-2026-128103

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs do set acl cifs set acl validates ACL size using posix acl xattr size: 4 + count 8 // 4-byte header + 8 bytes per ACE cifs do set acl then calls posix acl to cifs to write the CIFS wire form...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from KVM x86/mmu failing to properly handle an unexpectedly set SS bit in NPF exit codes, resulting in an out-of-bounds access in permissionfault...

CVE-2026-99149

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...

CVE-2026-99210

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...