Fedora 44 : evolution (2026-99a4ff5552)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-99a4ff5552 advisory. Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859. Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-93146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that...

DEBIAN-CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

DEBIAN-CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

AZL-102272 CVE-2026-90196 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

EUVD-2026-82254

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93146

CVE-2026-93146 is a Linux kernel vulnerability in the time/namespace subsystem. The function proc_timens_set_offset() validates the tv_sec field but fails to validate that tv_nsec is within the required range [0, NSEC_PER_SEC-1] before passing it to timespec64_add() , which expects normalized val...

CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

EUVD-2026-82144

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92523 RDMA/nldev: validate dynamic counter attribute length

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

EUVD-2026-82099

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

EUVD-2026-81928

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90051

CVE-2026-90051 affects the Linux kernel's TCP devmem (device memory) TX path . When NETIF_F_SG is absent, devmem TCP TX was not rejected even though it requires zero-copy; tcp_sendmsg_locked() would take the copy path and attempt to read from a dma-buf iovec, breaking invariants assumed by commit...

EUVD-2026-81336

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-20285

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

DEBIAN-CVE-2026-77406

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 o...

AZL-103188 CVE-2026-77406 affecting package keda 2.14.1-19

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 o...

EUVD-2026-80440

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...