Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013529)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013529 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid device tree lookups in rtasosterm rtasosterm is called during panic. Its...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013484 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - fix the aead software fallback for engine Due to the subreq pointer misus...

CVE-2026-31451: Reachable Assertion

In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUGON with proper error handling in ext4readinlinefolio Replace BUGON with proper error handling when inline data size exceeds PAGESIZE. This prevents kernel panic and allows the system to continue running while...

PT-2026-95378

Name of the Vulnerable Software and Affected Versions rustls-webpki versions 0.103.0 through 0.103.12 rustls-webpki versions 0.104.0-alpha through 0.104.0-alpha.6 Description A denial of service occurs due to a panic in the bit string flags function within src/der.rs. The issue arises when the...

PT-2026-34546

Impact An untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key. Hashing an election macro header hashes validators and reaches Validators::voting keys, which calls validator.voting key.uncompress.unwr...

CVE-2026-34065: Unchecked Return Value

nimiq-primitives contains primitives e.g., block, account, transaction to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key. Hashi...

CVE-2026-34063: Reachable Assertion

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, network-libp2p discovery uses a libp2p ConnectionHandler state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer...

PT-2026-34544

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, network-libp2p discovery uses a libp2p ConnectionHandler state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer...

Nimiq numerical error vulnerability

Nimiq is an open-source implementation of the Albatross protocol in Rust. Versions of Nimiq prior to 1.3.0 contained a numerical error vulnerability. This vulnerability stems from the nimiq-account contract’s VestingContract::canchangebalance function, which returns AccountError::InsufficientFund...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from l2capecredconnreq not verifying the number of SCIDs, resulting in an out-of-bound read of the sta...

CVE-2026-31517: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix skbput panic on non-linear skb during reassembly In iptfsreassemcont, IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First a zero-copy approach is tried if it succeeds...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from iptfs’ call to skbput during the recombination process for non-linear skb objects, potentially...

Nimiq security vulnerabilities

Nimiq is an open-source implementation of the Albatross protocol in Rust. Versions of Nimiq prior to 1.3.0 contained a security vulnerability. This vulnerability stemmed from the network-libp2p library’s use of the libp2p ConnectionHandler state machine. This handler assumes that each connection...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013671 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's runwork may be racing...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013702)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013702 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access sroot while i...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013434 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: always panic when errors=panic is specified Before commit 014c9caa29d3 ext4: make ext4abort...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013449 advisory. In the Linux kernel, the following vulnerability has been resolved: dm rq: don't queue request to blk-mq during DM suspend DM uses blk-mq's quiesce/unquiesce to...

CVE-2026-34067: Reachable Assertion

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, HistoryTreeProof::verify panics on a malformed proof where history.len != positions.len due to asserteq!history.len, positions.len. The proof object is derived from untrusted p2...

CVE-2026-40943

Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat method uses a blocking channel send while holding a mutex, and under specific timin...

CVE-2026-40943 Oxia: Server crash via race condition in session heartbeat handling

Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat method uses a blocking channel send while holding a mutex, and under specific timin...