SUSE CVE-2026-99049

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

tetragon-dirtyfrag

tetragon-dirtyfrag Blocking the DirtyFrag Linux privilege-escalation chain CVE-2026-43284 / CVE-2026-43500 at runtime with a Cilium Tetragon TracingPolicy. The policy SIGKILLs the public proof-of-concept at its socket-setup step, before it reaches the page-cache write that would give it root. Wha...

CVE-2026-115892

A flaw was found in Wasmtime. A malicious WebAssembly guest can cause a Denial of Service DoS by triggering an unhandled host runtime panic. When handling asynchronous streams or futures exchanged between the host and guest, Wasmtime fails to properly validate payload data types upon their return...

Malware in orqiva-runtime-win32-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

OSEC-2026-23 Multiple issues in Marshal

Several issues have been discovered in the Marshal module: ANT-2026-K7NTK0FT Stale objcounter across unmarshal calls enables null/freed internobjtable indexing ANT-2026-2NJYQWEX Custom block size wraparound in CODECUSTOMLEN allocation ANT-2026-PJC00M7X Unmarshaler accepts forged Closuretag metada...

Tokio: Race condition in `tokio::time::Interval`

Summary On the multi-threaded runtime, there is a race condition between Interval::polltick and the runtime's time driver. This affects Interval only. Sleep and Timeout are not affected. Details In Tokio v1.54.0, a race condition between tokio::time::Interval::polltick including .tick.await and t...

HARDE

HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control Code release for HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control. The repository contains two complementary entry-point families: domains/: the Meta-Harness baseline and the two...

EUVD-2026-108844

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-99049

The Linux kernel contains a runtime PM leak within the xilinx gpio driver. The issue occurs because pm_runtime_get_sync() increments the usage counter even on failure, and xgpio_request() returns errors without releasing the reference. Because gpiolib fails to call ->free() on request errors, ...

CVE-2026-99049

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-99049 gpio: xilinx: fix runtime PM leak on request error path

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-99034

The Linux kernel contains a vulnerability in the sdhci-sprd driver where the sdhci_sprd_remove() function fails to perform necessary runtime PM cleanup . While sdhci_sprd_probe() enables runtime PM, the removal path directly disables clocks managed by runtime PM callbacks without proper cleanup. ...

EUVD-2026-108829

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...

CVE-2026-99034 mmc: sdhci-sprd: disable runtime PM on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...

CVE-2026-99034

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...

CVE-2026-98946 drm/vc4: Disable the V3D interrupt across runtime suspend

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

EUVD-2026-108920

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

CVE-2026-98946

The Linux kernel contains a vulnerability in the drm/vc4 driver where the V3D interrupt is not properly quiesced during runtime suspend. On RPi 0-3 , the use of the ARMCTRL interrupt controller allows a CPU to acknowledge an interrupt without it becoming visible to synchronize_irq(). This can cau...

EUVD-2026-108905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...