PT-2026-93677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the NFSD component during blocked-lock reaping. A bare lock owner on nn-blocked locks lru holds a raw pointer to its nfs4 client without a reference to...

PT-2026-93461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs during a GPU reset. The dm suspend function acquires the dc lock and expects dm resume to release it. However, if the functions amdgpu dm commit zero streams or dm dmu...

PT-2026-93684

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the zram module where the slot lock bit position is incorrectly handled on big-endian 64-bit systems. The slot lock is a bit operation performed on the lock word, whic...

Linux Distros Unpatched Vulnerability : CVE-2026-89897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower chec...

Linux Distros Unpatched Vulnerability : CVE-2026-89820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams ...

CVE-2026-89857: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

Linux Distros Unpatched Vulnerability : CVE-2026-90036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds ...

Linux Distros Unpatched Vulnerability : CVE-2026-89956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist...

kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...

CVE-2026-91773

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

EUVD-2026-78249

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

CVE-2026-91773 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

PT-2026-91832

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

CVE-2026-91773: Authorization Bypass Through User-Controlled Key

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fixed a use-after-free in stateshow stateshow reads kdamond-damonctx without holding damonsysfslock. This allows for a use-after-free race condition: CPU 0 CPU 1 ----- ----- stateshow damonsysfsturndamonon ctx =...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: dropping peer group IDs under namespace lock When cleaning up peer group IDs in the failure path, we need to ensure that the namespace lock is retained. Otherwise, another thread might simultaneously change the mount status...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ceph: Fix for a possible deadlock when holding Fwb to get inlinedata 1. Mount with wsync. 2. Create a file with ORDWR, and the request is sent to mds.0: cephatomicopen -- cephmdscdorequestopenc finishopenfile, dentry, cephopen --...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed an issue related to “slab-use-after-free” in ksmbdsmb2sessioncreate. There is a race condition between ksmbdsmb2sessioncreate and ksmbdexpiresession. This patch adds the necessary sessionstablelock during the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: uinput – fixed a circular locking dependency with ff-core A circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput for example, playing ELDEN RING under Wine with ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: migrate: corrected lock ordering for hugetlb file folio operations Syzbot has identified a deadlock analyzed by Lance Yang: 1 Task 5749: Holds foliolock, then attempts to acquire immaprwsem read lock. 2 Task 5754: Holds...