PT-2026-64669

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2 check message has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server...

PT-2026-64674

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio disconnect walks usbio-cli list in reverse and uninitializes each auxiliary device. auxiliary device uninit drops the device reference, and for an unbound child that c...

PT-2026-64547

In the Linux kernel, the following vulnerability has been resolved: block: skip sync blockdev on surprise removal in bdev mark dead bdev mark dead's @surprise == true means the device is already gone. The filesystem callback fs bdev mark dead honours this and skips sync filesystem, but the bare...

PT-2026-64480

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server io uring cmd done not call...

PT-2026-64502

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc rdma sq wait on sc sq ticket wait or sc send wait can hang indefinitely in TASK UNINTERRUPTIBLE state across transport teardown, pinning svc xprt references...

PT-2026-64706

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd compr task new allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its tas...

openSUSE 16 Security Update : apache-ivy (openSUSE-SU-2026:21424-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21424-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting...

Linux Distros Unpatched Vulnerability : CVE-2026-64431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore...

Linux Distros Unpatched Vulnerability : CVE-2026-64438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF- side response work that stores a raw pointer to per-VF stat...

Linux Distros Unpatched Vulnerability : CVE-2026-64359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod ...

PT-2026-64638

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker debugfs add creates both "count" and "scan" debugfs files unconditionally. That assumes every shrinker implements both count objects and scan objects, which is not...

PT-2026-64657

In the Linux kernel, the following vulnerability has been resolved: net: af key: initialize alg key len for IPComp states pfkey msg2xfrm state handles the IPComp SADB X SATYPE IPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmalloc objx-calg; if !x-calg err = -ENOME...

PT-2026-64599

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup writeback umount and inode switch wbs When a container exits, the following BUG ON is occasionally triggered: ================================================================== VFS: Busy inodes...

Linux Distros Unpatched Vulnerability : CVE-2026-64391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS...

Linux Distros Unpatched Vulnerability : CVE-2026-64423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast li...

Linux Distros Unpatched Vulnerability : CVE-2026-64433

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not...

Linux Distros Unpatched Vulnerability : CVE-2026-64469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix UAF in binderthreadrelease When a thread exits, binderthreadrelease walks its transaction stack to clear the t-from and t-toproc that correspond wit...

Linux Distros Unpatched Vulnerability : CVE-2026-64210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt o...

Linux Distros Unpatched Vulnerability : CVE-2026-64468

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix UAF in binderfreetransaction In binderfreetransaction, the t-toproc is read under the t-lock. However, once the t-lock is dropped, the toproc can di...

Linux Distros Unpatched Vulnerability : CVE-2026-64415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/swap: add condresched in swapreclaimfullclusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP...