Linux Distros Unpatched Vulnerability : CVE-2026-98451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen o...

PT-2026-116872

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccess shadow fault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat entry walk will not find any leaf entry and...

PT-2026-116728

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio gpu execbuffer ioctl reserves a DRM event with drm event reserve init when VIRTGPU EXECBUF RING IDX selects a ring that userspace has enabled polling for...

PT-2026-117027

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm sysport get stats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm sysport get stats. The variable 'j' tracks the compacted index into the...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

PT-2026-116999

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu discovery sysfs ips allocates ip hw instance with kzalloc flex and initializes its embedded kobject before calling kobject add. If kobject add fails, the retur...

PT-2026-116721

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps input configured allocates a second input device "DualPoint Stick" with input allocate device and registers it, but the alps driver struct has no .remove handler a...

CVE-2026-98842: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98435: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altrportbsetup Anchor the devres group and the devm-managed IRQ requests in altrportbsetup to the actual parent device device-edac-dev instead of the embedded struct device inside the...

CVE-2026-112012: Out-of-bounds Write

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-98780: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

PT-2026-116669

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound send recv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already...

PT-2026-116818

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack slot obj get spi bpf get spi computes -off - 1 / BPF REG SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot...

PT-2026-116887

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio push to buffers with ts unaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is...

PT-2026-116875

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable work before freeing trigger iio trigger notify done atomic defers -reenable into trig-reenable work on the system workqueue, and the worker dereferences the owning trigger through container of. Nothi...

PT-2026-116920

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

PT-2026-116929

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945 pci probe calls il eeprom init, which allocates memory for the EEPROM data. The probe failure paths release this allocation with il eeprom free, but the remove path does not...

PT-2026-116979

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec partner desc in tps6598x connect tps6598x connect passes a stack-allocated typec partner desc to typec register partner after initializing only usb pd, accessory and identity. typec...

PT-2026-117030

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's tcf chain tp dele...

PT-2026-116890

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devm thermal of zone register fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to err map to release them...