PT-2026-121948

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm add action or reset invokes the cleanup action immediately when registering the action fails. gpio exar probe currently stores the allocated ID in exar gpio only...

ROS-20261023-73-0254

The vulnerability in PHP is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261023-73-1204

The vulnerability in PHP is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...

PT-2026-122000

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of regulator bulk get all of regulator bulk get all allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c...

Important: php:8.0 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-121910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request irq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

PT-2026-122213

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate tlb page in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and glob...

PT-2026-122057

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

PHP 5.6.40 State Corruption Mitigation

PHP version 5.6.40 is affected by state corruption following an out-of-memory bailout and stale global-state reuse across requests. This package supplies a Debian 7 wheezy backport of the mitigation...

Zephyr resource management error vulnerability

Versions Zephyr 4.3.0 through 4.5.0 contain a resource management error vulnerability. This vulnerability arises because when the arm64 MMU backend uses invalidatetlbpage in arch/arm64/core/mmu.c, the TLBI VAE1IS operand matches only ASID 0 and global entries. As a result, cache invalidation cann...

ROS-20261023-73-0014

The vulnerability of the dnsnametolabels function in the Libevent asynchronous event notification library is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

ROS-20261023-73-0054

The vulnerability in libpcap is related to the issue of operations going beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2026-121914

In the Linux kernel, the following vulnerability has been resolved: sched ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init cids overrides...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...

PT-2026-122442

Summary create entity, link entities, rename entity, unlink entities and delete entity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

ROS-20261023-73-0022

The vulnerability in libssh2 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-113679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a...