PT-2026-2533

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc4-virtme-g36b21a067510 Description The Linux kernel contains a use-after-free flaw within the mlxsw spectrum router component. This issue occurs when dereferencing a neighbour, potentially leading to...

EUVD-2025-150372

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

Siemens SIMATIC S7-1500 Use After Free (CVE-2024-26957)

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

AZL-70115 CVE-2025-40202 affecting package kernel for versions less than 6.6.117.1-1

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

CVE-2025-40202

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

CVE-2025-40202

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

CVE-2025-40202 ipmi: Rework user message limit handling

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

CVE-2025-40202 ipmi: Rework user message limit handling

In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all done to handle more in the receive messag...

drm/scheduler: fix fence ref counting

...

kernel: padata: avoid UAF for reorder_work

In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorderwork Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorderwork. This issue can happen just as below: cryptorequest cryptorequest cryptodela...

kernel: can: j1939: j1939_session_new(): fix skb reference counting

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939sessionnew: fix skb reference counting Since j1939sessionskbqueue does an extra skbget for each new skb, do the same for the initial one in j1939sessionnew to avoid refcount underflow. mkl: clean up commit messag...

kernel: smc: Fix use-after-free in tcp_write_timer_handler()

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcpwritetimerhandler. With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcpwritetimerhandler by kernel TCP sockets. 0 If SMC creates a kernel socket in smccreate, the kernel...

kernel: nfsd: put dl_stid if fail to queue dl_recall

In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the callbackwq, we increment the reference count of dlstid. We expect that after the corresponding workstruct is processed, the reference...

kernel: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first and later forwarded to brioctlcall, which causes unnecessary RTNL dance and the splat below 0 under RTNL pressure. Let's say Thread A...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990583)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990583 advisory. In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards o...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989870)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989870 advisory. In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939sessionnew: fix skb reference counting Since j1939sessionskbqueue does an extra...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989889)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989889 advisory. In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpmchip The following sequence of operations results in a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989006 advisory. In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpccall struct has a timer used to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990266 advisory. In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939sessionnew: fix skb reference counting Since j1939sessionskbqueue does an extra...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990243 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fai...