PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...

PT-2026-122057

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

PT-2026-122155

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The ra...

PT-2026-122431

Summary An allocation-without-limits vulnerability CWE-770 in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with IAC SB and then streams bytes without ever sending the IAC SE...

ROS-20261023-73-0054

The vulnerability in libpcap is related to the issue of operations going beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2026-122413

Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialise...

Linux Distros Unpatched Vulnerability : CVE-2026-98906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the...

Linux Distros Unpatched Vulnerability : CVE-2026-113790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements,...

Linux Distros Unpatched Vulnerability : CVE-2026-99036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.24 / 10.4.x < 11.3.10 (JSDSERVER-16700)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16700 advisory. - Netty is a network application framework for development of protocol servers and clients. In version...

AlmaLinux 9.6 [TuxCare] Security Update: librabbitmq / librabbitmq-devel / librabbitmq-tools (ALMALINUX9.6:CLSA-2026:1792765036)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792765036 advisory. - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized...

Linux Distros Unpatched Vulnerability : CVE-2026-98942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes...

Linux Distros Unpatched Vulnerability : CVE-2026-98944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn...

Linux Distros Unpatched Vulnerability : CVE-2026-112059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizi...

Linux Distros Unpatched Vulnerability : CVE-2026-99014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-99080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c...

PT-2026-121890

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon ptep mkold damon va prepare access check picks a random byte address within the region and stores it in r-sampling addr. damon va mkold passes it into a page table walk,...

PT-2026-122006

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5 tc matchall replace allocates a struct sparx5 mall entry for every offloaded matchall filter and adds it to sparx5-mall entries. sparx5 tc matchall destroy removes the entry...

Linux Distros Unpatched Vulnerability : CVE-2026-99010

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns th...

Rocky Linux 9.6 [TuxCare] Security Update: librabbitmq / librabbitmq-devel / librabbitmq-tools (ALMALINUX9.6:CLSA-2026:1792765036)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792765036 advisory. - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized...