CVE-2026-89570: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

PT-2026-90308

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description The rocket job push function contains a NULL pointer dereference and an integer overflow. The function allocates a temporary array to store input and output GEM object pointers. A failure in...

PT-2026-90395

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A null dereference exists in the nfsd4 setattr function when processing SETATTR requests. If a request includes FATTR4 WORD2 TIME DELEG ACCESS or FATTR4 WORD2 TIME DELEG MODIFY in the...

PT-2026-90260

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Four coupled defects in the gssx XDR option-array decoder create unsafe error paths. These issues include a NULL dereference in the caller, a reference count leak on the decoded group...

PT-2026-90263

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the SUNRPC component, the svc create function initializes three per-pool percpu counter stats but fails to check the return values. On SMP systems, if percpu counter init fails due to...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2026:3835-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3835-1 advisory. OpenSSL is updated to 3.5.0 in SLE-15-SP7: jscPED-16072 Enables Post-Quantum Cryptography PQC TLS support...

PT-2026-90114

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the SMC-D teardown path where the system may dereference an unset send buffer. This occurs because smc close stream wait invokes smc tx prepared sends within a sk wait eve...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107277)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107277 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bioendio on t...

PT-2026-90425

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lockd and nfsd components where nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown using plain stores. Because lockd dereferences this...

PT-2026-90222

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/uverbs component where the UVERBS METHOD REG MR method failed to include UVERBS ATTR UHW. This omission affects the mthca, irdma, and siw drivers, which have...

CVE-2026-89679: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4setattr for deleg timestamp attrs When a SETATTR request includes FATTR4WORD2TIMEDELEGACCESS or FATTR4WORD2TIMEDELEGMODIFY in the attribute bitmap, nfsd4setattr sets delegattrs=true and calls...

PT-2026-96526

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx dec option array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group info, and a latent...

PT-2026-90286

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Lifetime issues in the CXL MCE notifier can lead to NULL dereferences and use-after-free conditions within the MCE handler. This occurs because the notifier was registered per memory...

PT-2026-90193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the SCTP implementation of the Linux kernel. The issue occurs when completing a pending stream reconfiguration request that has been published in...

PT-2026-90234

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where certain kernel functions incorrectly assume that the current CPU is always the same as the dispatched runqueue rq. Under core scheduling,...

PT-2026-90378

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the NFSD client teardown process. The destroy client function releases a client's open owners, but a lock owner whose only reference is a blocked lock...

PT-2026-90086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache component where the get cache segment function scans the segment map up to the physical device segment count, while cache segs init only initializes segments...

PT-2026-90233

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the core scheduling of the Linux kernel where the pick next task function can experience state corruption. This occurs when selections on the same core interleave due ...

CVE-2026-89477: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctpprocessstrresetoutreq, sctpprocessstrresetaddstrmout and sctpprocessstrresetresp complete a pending stream reconfiguration request by stopping the reconf timer on the...

CVE-2026-89484: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...