CVE-2026-64500: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its interrupt handler with devmrequestirq before it initializes...

PT-2026-64721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lpc32xx adc probe function within the drivers/iio/adc/lpc32xx adc.c file. The function registers an interrupt handler using devm request irq before initializing th...

CVE-2026-64417: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinkerdebugfsadd creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both countobjects and scanobjects, which is not...

CVE-2026-64474: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

Linux Distros Unpatched Vulnerability : CVE-2026-64324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops th...

Linux Distros Unpatched Vulnerability : CVE-2026-64500

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: lpc32xxadcprobe in drivers/iio/adc/lpc32xxadc.c registers its...

Linux Distros Unpatched Vulnerability : CVE-2026-64275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts ...

Linux Distros Unpatched Vulnerability : CVE-2026-46600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-46600 Note that Nessus relies on the...

GHSA-JPCW-4WR7-C3VQ kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GHSA-26GQ-P25F-99CP frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...

GO-2026-5266 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp

GoBGP: Remote Denial of Service Panic in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp...

GO-2026-5954 GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp

GoBGP confederation validation panics on empty ASPATH attribute in github.com/osrg/gobgp...

GO-2026-5543 Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp

Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp...

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

GHSA-CQJC-RMPQ-XPRQ Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

GHSA-5XVQ-CP9X-6P6R Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

DEBIAN-CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...