CVE-2026-68237 drm/amdgpu/userq: fix indefinite fence wait during GPU reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68237

CVE-2026-68237 resolves an indefinite fence wait in drm/amdgpu/userq during a GPU reset. The pre_reset path only force-completes fences of MAPPED queues, leaving fences for queues in states like mid-eviction pending; after a reset, those fences may never signal, causing eviction/suspend workers a...

EUVD-2026-55338

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68222 media: msi2500: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

CVE-2026-68204

CVE-2026-68204 affects the Linux kernel media subsystem (vivid driver). The vulnerability arises because vivid_update_format_cap/out() may be invoked to change formats while the capture/output queue is still busy, due to missing vb2_is_busy() checks when toggling CROP/COMPOSE/SCALE capabilities. ...

EUVD-2026-54681

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...

CVE-2026-64291

A flaw was found in the Linux kernel's iommufd subsystem. A local user could exploit this vulnerability by allocating excessively large event queues, leading to the exhaustion of kernel memory. This can result in a Denial of Service DoS for the system...

CVE-2026-64292

A flaw was found in the Linux kernel's iommufd component. A local user can exploit this vulnerability by allocating large veventq queues, which are processed inside a spinlock. This can lead to the exhaustion of atomic memory reserves, resulting in a Denial of Service DoS condition...

CVE-2026-63239

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

kernel security, bug fix, and enhancement update

5.14.0-687.30.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

EUVD-2026-49847

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...

CVE-2026-57215

A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to...

UBUNTU-CVE-2026-64232

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

SUSE CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

CVE-2026-64261

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

UBUNTU-CVE-2026-64261

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

CVE-2026-64281

CVE-2026-64281 affects the Linux kernel svcrdma transport (svc_rdma) where threads parked in svc_rdma_sq_wait() could hang indefinitely during transport teardown due to missing wakeups on close. The fixed flow adds svc_rdma_xprt_deferred_close(), which calls svc_xprt_deferred_close() and then wak...

CVE-2026-64281 svcrdma: wake sq waiters when the transport closes

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...