CVE-2026-99105

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without...

PT-2026-128194

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

PT-2026-128096

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker pool in node activate pending pwq: BUG: KASAN: slab-use-after-free in raw spin trylock+0x6d/0x120 Read of size 4 at addr...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

PT-2026-128155

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-dev id. Fix a potential UAF by duplicating the...

PT-2026-128173

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic ci d hash and generic ci d compare read sb-s encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu read lock. The filesystems that use them,...

PT-2026-128121

In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp inq pop currently accepts shorter declared lengths. A zero-length chunk leaves chunk end at the current header. Whe...

UBUNTU-CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

PT-2026-128107

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS CONTROL INFORMATION smb2 get info filesystem reports 48 bytes for FS CONTROL INFORMATION, that is the whole of struct smb2 fs control info, but never assigns FileSystemControlFlags...

PT-2026-128097

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx bypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates onl...

PT-2026-128164

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs put super and ntfs3 kill sb drop th...

PT-2026-128099

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser bos amdgpu cs parser bos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu cs parse...

PT-2026-128137

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run deferred takes it, and the RCU callback that fre...

UBUNTU-CVE-2026-99194

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

PT-2026-128079

Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 Linux before build 42587...

PT-2026-128178

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw core handle response or split transaction timeout callback may manipulate the same transaction entry in the pending transaction...

UBUNTU-CVE-2026-99151

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocateusb4bandwidthforstream and allocateusb4bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in productio...

Linux Distros Unpatched Vulnerability : CVE-2026-99203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two...

Oracle Linux 10 : libXi (ELSA-2026-91004)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91004 advisory. 1.8.1-7.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270054 Tenable has extracted the preceding description block directly fr...

Rocky Linux 10.2 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_89761)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689761 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...