Moderate: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2026:67145 Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

CVE-2026-15891

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

CVE-2026-90648

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc in wasmrtallocatefuncreftable wasm2c/wasm-rt-impl-tableops.inc. When the funcref table allocation...

SUSE CVE-2026-89484

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

SUSE CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

SUSE CVE-2026-89561

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6rplsrhrcv ipv6rplsrhrcv dereferences idev from in6devget without a NULL check when reading idev-cnf.rplsegenabled. When the device's MTU drops below IPV6MINMTU, addrconfifdown clears...

Linux Distros Unpatched Vulnerability : CVE-2026-89442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user- supplied socketid with 'socketid topologymaxpackages', but...

Linux Distros Unpatched Vulnerability : CVE-2026-89592

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object...

Linux Distros Unpatched Vulnerability : CVE-2026-89477

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending...

Linux Distros Unpatched Vulnerability : CVE-2026-89570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-fre...

Linux Distros Unpatched Vulnerability : CVE-2026-89484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to...

Linux Distros Unpatched Vulnerability : CVE-2026-89709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences...

Linux Distros Unpatched Vulnerability : CVE-2026-89505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through...

Linux Distros Unpatched Vulnerability : CVE-2026-89696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and...

Linux Distros Unpatched Vulnerability : CVE-2026-89451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before...

Linux Distros Unpatched Vulnerability : CVE-2026-89662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked...

Linux Distros Unpatched Vulnerability : CVE-2026-89517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Fix rq-corepick corruption under core scheduling Core scheduling's picknexttask picks what to run on every SMT sibling of the core in a single pass...

CVE-2026-89570

A flaw was found in the Linux kernel's Compute Express Link CXL subsystem. Lifetime issues with the CXL Machine Check Exception MCE notifier can lead to NULL dereferences and use-after-free vulnerabilities in the MCE handler. This could allow an attacker to cause system instability or a denial of...

CVE-2026-89662

A flaw was found in the Linux kernel's Network File System Daemon NFSD. During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can result in a NULL dereference, potentially causing a system crash...