PT-2026-94831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/nldev component where the nested attribute RDMA NLDEV ATTR STAT HWCOUNTERS is not properly validated. The top-level policy only validates the container and...

SUSE CVE-2026-89475

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in the functionstatshow function. Check whether the denominator expression x x - 1 1000 mod 2^32, 2^64 results in zero, and skip the calculation of stddev in such cases. For now, don’t wor...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt7921s – Fixed the issue where potentially hung tasks might occur during chip recovery. During chip recovery e.g., chip reset, there is a possibility that the kernel worker resetwork holds a lock and waits for the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: procfs: Fixed a missing RCU protection when reading realparent in dotaskstat. When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection. This leads to the following sequence of events: cpu 0 c...

SUSE CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

Linux Distros Unpatched Vulnerability : CVE-2026-89460

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run...

CVE-2026-89460

A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the perf stat command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly online CPUs, leading to a null pointer dereference. Successful...

CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

UBUNTU-CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460

CVE-2026-89460 affects the Linux kernel on s390 systems using the CPUMF (Command Processor Measurement Facility) PMU driver. The root cause is that per-CPU cpu_cf_events structures are allocated only for CPUs online at event-creation time. If a CPU is hotplugged online during a perf stat run with...

CVE-2026-89460 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89475: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

PT-2026-90176

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 CPUMF facility where the kernel can crash when CPUs are hotplug added during the execution of a command such as perf stat -e cycles -- . The root cause is the...

PT-2026-96490

In the Linux kernel, the following vulnerability has been resolved: s390/cpum cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu cf events at first event...

CVE-2026-89460: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

Important: kbd

Issue Overview: openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the...