kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

SUSE CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

RHEL 7 : kernel (RHSA-2026:63538)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63538 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

PT-2026-85654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the nvmet execute identify nslist function. This occurs when a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I...

PT-2026-91355

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input register device exposes the device to userspace immediately. In joycon input create it was called before joycon config rumble configures the FF RUMBLE capabili...

PT-2026-91356

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcomm mutex for the deferred setup accept rfcomm sock recvmsg completes a deferred setup by calling rfcomm dlc accept without holding any RFCOMM lock: if test and clear bitRFCOMM DEFER SETUP, &d-flags...

PT-2026-91782

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p bools.nprim comes from the policy image independently of how many booleans follow it, and cond index bool fills bool val to struct at value - 1, so a count larger than the valu...

Linux Distros Unpatched Vulnerability : CVE-2026-80912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value t...

Linux kernel Bluetooth Buffer Overflow

The vulnerability in the hciuartregisterdev function within the drivers/bluetooth/hcildisc.c file of the Linux kernel Bluetooth device driver is related to dereferencing a pointer with an expired lifetime. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality,...

CVE-2026-80118: NULL Pointer Dereference

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handl...

PT-2026-85656

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1 Description An issue exists in the ALSA scarlett2 component where the scarlett2 init notify function incorrectly uses mixer-urb, which is allocated by snd usb mixer status create for the UAC2 status...

PT-2026-85657

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1 Description An issue exists in the ALSA FCP component where the fcp init notify function incorrectly uses mixer-urb, which is allocated for the optional UAC2 status interrupt endpoint. On devices with...

CVE-2026-80813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

PT-2026-91308

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handle esp restores skb-dev from the saved skb iif before passing the packet into the XFRM input path. Queued TCP data ca...

PT-2026-85724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFRM implementation where ESP-in-TCP records are processed via the TCP strparser. The handle esp function restores skb-dev from the saved skb iif before the packet...

CVE-2026-80913: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...

CVE-2026-80817: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...