Linux Distros Unpatched Vulnerability : CVE-2026-98577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like u matches longe...

OPENSUSE-SU-2026:22134-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g: gh release/run/attestation download and repo read-file --output could write to an unintended...

CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

UBUNTU-CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

DEBIAN-CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

AZL-109131 CVE-2026-98577 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

PT-2026-116796

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc llcp wks sap nfc llcp wks sap compares only service name len bytes, so a short service name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exa...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

The Coder software versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 are vulnerable to a credential theft flaw. The root cause is an improper hostname validation in GetWorkspaceProxyByHostname, where a SIMILAR TO pattern performs a prefix match . This ...

Oracle Linux 10 : sssd (ELSA-2026-77534)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-77534 advisory. - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in evalaccesstokenbuf - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP...

sssd security update

2.12.0-3.0.1.el102.2 - Restore default debug level for ssscache Orabug: 32810448 2.12.0-3.2 - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in evalaccesstokenbuf 2.12.0-3.1 - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tre...

PT-2026-105117

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

GHSA-88H9-XGVX-HVF2 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Impact When using RBAC to apply authentication rules, the exact path method name matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different...

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Impact When using RBAC to apply authentication rules, the exact path method name matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different...

CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...