Linux Distros Unpatched Vulnerability : CVE-2026-80861

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very...

CVE-2026-80854: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...

PT-2026-91357

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhci gen setup locates the operational registers using the capability length read from the very first register: xhci-op regs = hcd-regs + HC LENGTHreadl&xhci-cap...

PT-2026-85659

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD SYNC use-after-free on teardown arm smmu impl remove is registered as a devres action in arm smmu impl probe, before arm smmu init queues allocates smmu-cmdq.q.base. On a devres unwind, whether a...

SUSE CVE-2026-72284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fai...

SUSE CVE-2026-72298

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

SUSE CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

Linux Distros Unpatched Vulnerability : CVE-2026-80701

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the...

Linux Distros Unpatched Vulnerability : CVE-2026-80685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/util: don't read page2 for order-1 folios in snapshotpage snapshotpage currently reads page2 after checking nrpages 1, but it should only do so when nrpages ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002835)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002835 advisory. In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiodlookuptable Without the terminator, if a conid is passed to...

SUSE CVE-2026-72092

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

SUSE CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

UBUNTU-CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80701 drm/vmwgfx: enforce cursor size limits for MOB cursors

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80701

CVE-2026-80701 affects the Linux kernel 's DRM/vmwgfx (VMware graphics) driver. The root cause is that vmw_cursor_plane_atomic_check() enforces cursor width/height bounds only on the legacy update path, while the SVGA_CAP2_CURSOR_MOB path—the default on modern hosts—accepts any size. When an over...

EUVD-2026-67423

In the Linux kernel, the following vulnerability has been resolved: riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and freeinitmem unmaps the .init.text section. This function makes calls to...

CVE-2026-80685 mm/util: don't read __page_2 for order-1 folios in snapshot_page()

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read page2 for order-1 folios in snapshotpage snapshotpage currently reads page2 after checking nrpages 1, but it should only do so when nrpages 2. If an order-1 folio is allocated at the end of a vmemmap section,...

EUVD-2026-67528

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

SUSE CVE-2026-72091

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...