CVE-2026-64282 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvmtranslatevncr races MMU notifier In the case that kvmtranslatevncr races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to...

SUSE CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

Linux Distros Unpatched Vulnerability : CVE-2026-64051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO ...

CVE-2026-64149

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64149

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149

In the Linux kernel, CVE-2026-64149 fixes a DMA mapping sanity check: dma_map_resource() previously relied on pfn_valid() to exclude RAM, but this could misclassify MMIO regions sharing a sparsemem section as usable RAM, triggering a WARN_ON_ONCE and DMA_MAPPING_ERROR on platforms like Raspberry ...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...

CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

EUVD-2026-45624

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

PT-2026-61368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qaic gem object mmap function where the call to remap pfn range is susceptible to mapping beyond the Virtual Memory Area VMA if the Buffer Object BO is too large...

CVE-2026-53199

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN. Entries for the RNDIS header and the skb linear data come from...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfntopfncache locks in dedicated helper Move the gfntopfncache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvmgfntopfncacheinit’...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: x86/mm/pat: fixed the handling of VMPAT in COW mappings. The handling of VMPAT does not work correctly in COW mappings: the first PTE or, in fact, all PTEs can be replaced during write faults, causing them to point to anonymou...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/gpusvm: fixed the usage of hmmpfntomaporder Handled the case where the hmm range partially covers a large page such as 2M. Otherwise, we might end up doing something unpleasant, such as mapping memory that is outside the...

EUVD-2026-27690

In the Linux kernel, the following vulnerability has been resolved: ima: verify the previous kernel's IMA buffer lies in addressable RAM Patch series "Address page fault in imarestoremeasurementlist", v3. When the second-stage kernel is booted via kexec with a limiting command line such as "mem="...

CVE-2026-43129 ima: verify the previous kernel's IMA buffer lies in addressable RAM

In the Linux kernel, the following vulnerability has been resolved: ima: verify the previous kernel's IMA buffer lies in addressable RAM Patch series "Address page fault in imarestoremeasurementlist", v3. When the second-stage kernel is booted via kexec with a limiting command line such as "mem="...