CVE-2026-89329: Use of Blocking Code in Single-threaded, Non-blocking Context

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

PT-2026-90158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the ISST driver. The isst if clos assoc function incorrectly validates the user-supplied socket id using a greater-than comparison against topolog...

PT-2026-90113

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A socket reference count leak exists in the smc switch conns function. The issue occurs when the function takes a reference on the SMC socket but fails to call the corresponding sock put...

PT-2026-90155

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the platform/x86 ISST component where a missing NULL check for sst inst could lead to instability during failed socket loading. The fix involves implementing a check for...

GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

Packet-Sniffer v6.0.0

RootWire A network traffic monitor for GNU/Linux — formerly known as Packet-Sniffer. Frames are captured from one or more network interfaces with a raw socket, timestamped by the kernel itself, decoded layer by layer with the NETProtocols library, and rendered live, written to nanosecond-precisio...

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impactdjust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

kernel: Revert "net/smc: Introduce TCP ULP support"

A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...

kernel: tcp: call sk_data_ready() after listener migration

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...

Linux Distros Unpatched Vulnerability : CVE-2026-88924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the...

kernel security, bug fix, and enhancement update

5.14.0-687.46.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

AZL-99959 CVE-2026-80914 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

DEBIAN-CVE-2026-80914

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80920

In the Linux kernel, the following vulnerability has been resolved: iouring: defer eventfd signaling when queued from a wakeup handler ioreqlocalworkadd signals the CQ ring eventfd inline when it is the one to push the first entry onto -worklist. For DEFERTASKRUN rings that add is frequently done...

CVE-2026-80919

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB contents from a hung job, amdgpudevcoredumpformat acquired the VM root PD's reservation via amdgpuvmlockbypasid and then, for each IB, called...