PT-2026-94689

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the coreboot firmware handling where coreboot table probe replaces the platform resource length with header and table sizes provided by the firmware before mapping the...

PT-2026-94744

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the block layer where a failed integrity mapping retains a dio reference. This leads to a dio leak, requiring the system to process the full bio ending to account for...

CVE-2026-47887

A flaw was found in Spring Framework. A Spring MVC application utilizing UrlFileNameViewController with an end-of-path mapping and no configured prefix is susceptible to an open redirect vulnerability. This could allow an attacker to redirect users to arbitrary malicious websites, potentially...

DEBIAN-CVE-2026-90015

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

DEBIAN-CVE-2026-90012

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90012

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-89977

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

DEBIAN-CVE-2026-89931

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...

CVE-2026-89931

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...

DEBIAN-CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

DEBIAN-CVE-2026-89804

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with pagesize and records that length in dmainfo-size. For a compound folio pagesize is PAGESIZE 0 folio this...

CVE-2026-90015 xhci: fix lost bounce buffers on TDs spanning several ring segments

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...

CVE-2026-89977

CVE-2026-89977 affects the accel/ethosu driver in the Linux kernel . The root cause is a missing error check: devm_platform_ioremap_resource() can return an error pointer when the register resource cannot be mapped, but ethosu_probe() stores the pointer and continues execution until later initial...

CVE-2026-89977 accel/ethosu: check MMIO mapping errors in probe

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

CVE-2026-89961

CVE-2026-89961 affects the Linux kernel 's powerpc/mm subsystem, specifically the vmemmap_populate_compound_pages() function. The root cause is a mismatch in how addr_pfn is advanced relative to the loop's addr variable in vmemmap address space. Because each PAGE_SIZE step in addr spans PAGE_SIZE...

CVE-2026-89931

CVE-2026-89931 affects the Linux kernel's KVM nVMX (nested virtualization) subsystem. The root cause is that the KVM_REQ_GET_NESTED_STATE_PAGES flag is not reliably cleared when emulating a nested VM-Exit, specifically when KVM is built with CONFIG_KVM_HYPERV=n . Because KVM implicitly relies on ...

CVE-2026-89931 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...