CVE-2026-64290

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

PT-2026-64695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vfio mig get next state function where the loop used to skip unsupported optional states does not account for the VFIO DEVICE STATE ERROR sentinel. When a blocked...

DEBIAN-CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

CVE-2026-64218 batman-adv: bla: fix report_work leak on backbone_gw purge

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

Linux Distros Unpatched Vulnerability : CVE-2026-63980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in...

CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

EUVD-2026-45753

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63980 net/handshake: Use spin_lock_bh for hn_lock

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63980

CVE-2026-63980 affects the Linux kernel net/handshake path in NVMe targets. nvmet_tcp_state_change() can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(), where hn_lock was acquired with spin_lock(). If a process-context thread holds the lock while a ...

CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

PT-2026-61297

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Linux kernel when nvmet tcp state change a socket callback running in Bottom Half BH context triggers handshake req cancel via nvmet tcp schedule release queue a...

PT-2026-61479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the idpf ptp init function where the read dev clk lock spinlock is initialized after the ptp schedule worker function has been called. This sequence allows the PTP...

Security Bulletin: IBM Jazz Reporting Service is affected by Cross-site Scripting (XSS) of spin.js

Summary Spin.js is used internally by IBM Jazz Reporting Service. The vulnerability arises from the spin function, which can trigger multiple alert dialogs per target element. Vulnerability Details CVEID:CVE-2026-3884 DESCRIPTION: Versions of the package spin.js before 3.0.0 are vulnerable to...

pymolvis (0.3.0), spin-phonon-suite (>=1.7.0, <=1.20.1) potentially affected by CVE-2022-42964 via pymatgen (2024.6.10)

pymatgen PYPI version 2024.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on pymatgen and may be impacted: - pymolvis 0.3.0 - spin-phonon-suite =1.7.0, =1.20.1 Source cves: CVE-2022-42964 Source advisory: OSV:PYSEC-2026-909...

SUSE CVE-2026-53158

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpcrpmsgprobe has completed initialization: Unable to handle kern...

UBUNTU-CVE-2026-53239

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrmpolicybyselctx Fix the race by pruning the bin while still holding xfrmpolicylock, before dropping it. Use xfrmpolicyinexactprunebin directly since the lock is already held...

CVE-2026-53239 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrmpolicybyselctx Fix the race by pruning the bin while still holding xfrmpolicylock, before dropping it. Use xfrmpolicyinexactprunebin directly since the lock is already held...

EUVD-2026-39191

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on firstskb in inputprocesspayload inputprocesspayload stores firstskb into xtfs-ranewskb under droplock when starting partial reassembly, then unlocks and breaks out of the processing loop. The...

CVE-2026-53197

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix ABBA deadlock in iptfsdestroystate iptfsdestroystate calls hrtimercancel while holding a spinlock that the timer callback also acquires, leading to an ABBA deadlock on SMP systems. For the output timer iptfstimer...

CVE-2026-53158 misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpcrpmsgprobe has completed initialization: Unable to handle kern...