CVE-2026-90070

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv when the register-sele...

CVE-2026-90067

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90051

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

CVE-2026-92591

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:11+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-23 06:25:01+00:00| seen| https://bsky.app/profile/fortrabbit.com/post/3mw647katym2g...

CVE-2026-92592

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-19 05:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvtvlxhpnu2b 2026-10-03 07:00:09+00:00| seen|...

CVE-2026-92593

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:08+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-19 05:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvtvlzaqwv2w 2026-09-23 06:25:01+00:00| seen|...

CVE-2026-93375: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-90043

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves i...

CVE-2026-89974

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...

CVE-2026-89969

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmettcptryrecvpdu reads a PDU header into the fixed 128-byte queue-pdu union, then computes the remaining payload length as queue-left = hdr-hlen - queue-offset ...

CVE-2026-89924

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-89947

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

CVE-2026-89946

In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33runtimesuspend currently switches the codec into regcachecacheonlytrue and powers it down without first quiescing the threaded IRQ registered by...

CVE-2026-90035

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...

CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

UBUNTU-CVE-2026-90008

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...

CVE-2026-90040

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

UBUNTU-CVE-2026-89922

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...

UBUNTU-CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...