Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105436 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: Fix return type of netcpndostartxmit With clang's kernel control flow integrit...

openSUSE 16 Security Update : wicked2nm (openSUSE-SU-2026:21716-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21716-1 advisory. This update for wicked2nm fixes the following issue: Update to v1.5.2. Security issues fixed: - serdewith: KeyValueMap serialization panics on empty...

PT-2026-84928

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash occurs in the ring-buffer component during the late initcall self-test. In the test ringbuffer function's out free cleanup loop, the check !rb threadscpu only identifies NULL...

GO-2026-6321 alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http...

SUSE CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to...

golang.org/x/image/bmp: golang: golang.org/x/image/bmp: Denial of Service via out-of-range palette index in BMP decoding

A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP Bitmap file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...

SUSE CVE-2026-72334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...

SUSE CVE-2026-72369

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-80625

A flaw was found in the Linux kernel's RDMA/hns component. During concurrent driver removal and reset operations, bonding resources are incorrectly released and then re-allocated, leading to a memory leak. This memory leak can potentially cause a kernel panic, resulting in a Denial of Service DoS...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

OPENSUSE-SU-2026:21716-1 Security update for wicked2nm

This update for wicked2nm fixes the following issue: Update to v1.5.2. Security issues fixed: - serdewith: KeyValueMap serialization panics on empty sequence or map entries bsc1271848. Other updates and bugfixes: Builddeps: bump serdewith from 3.18.0 to 3.21.0. Fix flaky tests. Fix teamlacpethtoo...

CVE-2026-62994

A flaw was found in CoreDNS, a DNS server. A remote attacker can trigger a denial of service by sending a specially crafted AXFR request to a CoreDNS zone. This occurs when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint...

PT-2026-89833

This update for wicked2nm fixes the following issue: Update to v1.5.2. Security issues fixed: - serde with: KeyValueMap serialization panics on empty sequence or map entries bsc1271848. Other updates and bugfixes: Builddeps: bump serde with from 3.18.0 to 3.21.0. Fix flaky tests. Fix team lacp...

PT-2026-102988

This update for wicked2nm fixes the following issue: Update to v1.5.2. Security issues fixed: - serde with: KeyValueMap serialization panics on empty sequence or map entries bsc1271848. Other updates and bugfixes: Builddeps: bump serde with from 3.18.0 to 3.21.0. Fix flaky tests. Fix team lacp...

K000163145: Go JOSE vulnerability CVE-2026-34986

Security Advisory Description Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web...

SUSE CVE-2026-72394

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...