CVE-2026-89563: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-89746: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...

PT-2026-89869

Name of the Vulnerable Software and Affected Versions Headroom versions prior to 0.35.0 Description The Headroom WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows malicious WebSocket clients, which...

CVE-2026-81000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

PT-2026-96385

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun get user uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align ...

CVE-2026-89698: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

PT-2026-90241

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UDF 1.50 virtual partition mapping where the VAT Virtual Allocation Table is used as an array of physical block mappings. The s num entries variable stores the tot...

PT-2026-90167

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the SVA Shared Virtual Addressing implementation. The function iommu attach device pasid installs a new SVA attach handle in the group PASID lookup before iomm...

PT-2026-90193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the SCTP implementation of the Linux kernel. The issue occurs when completing a pending stream reconfiguration request that has been published in...

CVE-2026-89547: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89603: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...

CVE-2026-81000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

PT-2026-90376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Network File System server NFSD during admin state revocation. The problem occurs because a stateid contains a pointer to the nfs4 client without...

PT-2026-90352

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SMB client. When the free tgts function frees all structures within ce-tlist, the ce-tgthint variable continues to point to one of the freed cache df...

PT-2026-96426

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb-bblog shift in super 1 load In super 1 load, sb-bblog shift is an u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks set by the following sequence, 1930...

PT-2026-90368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab out-of-bounds write occurs in the NFS-export get name path when a CephFS mount is re-exported over NFS. The ceph get name function copies a name supplied by the Metadata Server MD...

PT-2026-96520

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4 ff encode layoutget The XDR buffer size calculation in nfsd4 ff encode layoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memor...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

PT-2026-90056

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd component during oplock break notification. The function smb2 oplock break noti reads the opinfo-conn variable without a lock and dereferences ...

PT-2026-90065

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An out-of-bounds write issue exists in the mt7996 mcu get eeprom function. The function determines the destination for the EFUSE/EXT block copy using the address provided in the MCU response...