ksmbd: vfs: fix race on m_flags in vfs_cache

...

CVE-2025-68812

In the Linux kernel, the following vulnerability has been resolved: media: iris: Add sanity check for stop streaming Add sanity check in irisvb2stopstreaming. If inst-state is already IRISINSTERROR, we should skip the streamoff operation because it would still send packets to the firmware. In...

CVE-2025-68780

A scheduling flaw was found in the Linux kernel's SCHEDDEADLINE implementation. The cpudlclear function can incorrectly set the freecpus bit for an offline CPU. This causes deadline tasks to be pushed to powered-down CPUs, where they cannot execute, resulting in task starvation for SCHEDDEADLINE...

Schneider Electric EcoStruxure Power Build Rapsody resource management error vulnerability

Schneider Electric EcoStruxure Power Build Rapsody is a power monitoring platform developed by Schneider Electric, a French company. Schneider Electric EcoStruxure Power Build Rapsody has a resource management vulnerability; this vulnerability stems from a double release issue during the import o...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002349 advisory. The xfrmstatenetlink function in net/xfrm/xfrmuser.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dumponestate function calls, which...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001886)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001886 advisory. The xfrmstatenetlink function in net/xfrm/xfrmuser.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dumponestate function calls, which...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003382)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003382 advisory. Race condition in the sctpwaitforsndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service assertion...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002072 advisory. The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service memory consumption by triggering a large number of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002677)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002677 advisory. The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the negative state to avoid a ra...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002287)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002287 advisory. arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003499)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003499 advisory. System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002871)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002871 advisory. The startthread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002821 advisory. The startthread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003423 advisory. The dccprcvstateprocess function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCPPKTREQUEST packet data structures in the LISTEN state, which...

CVE-2026-22814

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state...

UBUNTU-CVE-2025-71144

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect After the blamed commit below, if the MPC subflow is already in TCPCLOSE status or has fallback to TCP at mptcpdisconnect time, mptcpdofastclose skips setting the sendfastclose flag and t...

CVE-2025-71144 mptcp: ensure context reset on disconnect()

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect After the blamed commit below, if the MPC subflow is already in TCPCLOSE status or has fallback to TCP at mptcpdisconnect time, mptcpdofastclose skips setting the sendfastclose flag and t...

CVE-2025-71132 smc91x: fix broken irq-context in PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPTRT When smc91x.c is built with PREEMPTRT, the following splat occurs in FVPRevC: 13.055000 smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 13.062137 BUG: workqueue leaked...

CVE-2025-71113 crypto: af_alg - zero initialize memory allocated via sock_kmalloc

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - zero initialize memory allocated via sockkmalloc Several crypto user API contexts and requests allocated with sockkmalloc were left uninitialized, relying on callers to set fields explicitly. This resulted in the...

Cross-Site Request Forgery (CSRF)

fastapiusers is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to stateless and predictable OAuth state tokens with no session binding or per-request entropy, which allows an attacker to initiate an OAuth flow, reuse a valid state token, and trick a victim into completing...