UBUNTU-CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate CVE-2026-74496 In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev CVE-2026-74743 In the Linux...

PT-2026-128099

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser bos amdgpu cs parser bos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu cs parse...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It stems from icssmpruethnetdevinit calling ofPhyGetAndConnect prior to assigning netdevops, which results in a null pointer dereference during the probe process when CONFIGNETSHAPER is enabled...

UBUNTU-CVE-2026-99152

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsicompletepdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSIOPLOGOUTRSP: case ISCSIOPLOGINRSP: case...

CVE-2026-99152: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a…

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsicompletepdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSIOPLOGOUTRSP: case ISCSIOPLOGINRSP: case...

CVE-2026-99152

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsicompletepdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSIOPLOGOUTRSP: case ISCSIOPLOGINRSP: case...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.1. It arises because after a power event is registered, its callback may be triggered immediately by other contexts. If the power is disabled while the externalpowerchanged callback is still executing, the driver data may have already been...

UBUNTU-CVE-2026-99151

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocateusb4bandwidthforstream and allocateusb4bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in productio...

PT-2026-128181

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMAC RGSMIIIS, so RGSMIIIS stays pending behind GMAC INT...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793100968)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793100968 advisory. - In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse in udfrename syzbot reported a...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

PT-2026-128189

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000 probe calls au1000 mii probe, which connects the PHY, before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need o...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

UBUNTU-CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.18. It stems from schedtocore failing to search for all allocated core slots; after unbinding a non-last core, it returns NULL without checking the return value, which may lead to null pointer dereferencing...

PT-2026-128151

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring buffer map get reader The mmap reader can warn when it catches up with a writer that is still committing events. rb get reader page returns NULL in this case, but ring buffer map get reader...

Oracle Linux 10 : libXi (ELSA-2026-91004)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-91004 advisory. 1.8.1-7.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270054 Tenable has extracted the preceding description block directly fr...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.15. It stems from the use of an unvalidated firmware load address by dmcloadprogram in firmware header version 3 within DMC firmware, potentially leading to the use of invalid addresses...

PT-2026-128113

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...