Linux Distros Unpatched Vulnerability : CVE-2026-64090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs added checks to th...

CVE-2026-10755: Incorrect Authorization

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

Linux Distros Unpatched Vulnerability : CVE-2026-64009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned...

SUSE CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-64104

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64095

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.numrequests The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places announcement was received, backbone is purged, periodic work...

CVE-2026-64090

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

CVE-2026-64043

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an existing ovpn interface, there is a very narrow window where adding a new peer via netlink may cause the netdevice to hang and prevent its...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64003

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues While a SCSI host is in a recovery state, scsimqrequeuecmd will not set the requeue list for a requeued command to be kicked in the future. The expectation...

AZL-92823 CVE-2026-63974 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...

CVE-2026-63911

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfsclonestate clones the IPTFS mode data with kmemdup. This copies runtime objects which must not be shared with the original SA, including the embedded skbuffhead, hrtimers,...

CVE-2026-64177

CVE-2026-64177 is a Linux kernel vulnerability in the Phonet protocol (pep) handling where forwarding of skb to a child socket via sk_receive_skb() incorrectly acquires the child socket lock with BH enabled in the softirq path. The root cause is a BH state mismatch between softirq and process pat...

CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-64104 virt: sev-guest: Explicitly leak pages in unknown state

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64104 virt: sev-guest: Explicitly leak pages in unknown state

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64104

CVE-2026-64104 (Linux kernel) affects virt: sev-guest where set_memory_encrypted()/set_memory_decrypted() can fail leaving pages in an unknown state, potentially unencrypted and not safely returnable to the buddy allocator. The provided documentation notes that to avoid this, the pages should not...