PT-2026-97943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Improper exception masking in the arm64 hibernate code can lead to system crashes or warnings during the resume process. When a hibernation image is saved via swsusp arch suspend, all DA...

PT-2026-97962

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Intel PT Processor Trace implementation within the Linux kernel. When pt event stop is called without the PERF EF UPDATE flag, the perf aux output end function is...

PT-2026-104926

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMIT MEMLOCK limit. However the folios are unevictable and remain so until the inode is...

CVE-2026-93243: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...

PT-2026-97885

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management subsystem where madvise free huge pmd fails to properly handle device-private Page Middle Directories PMDs. A race condition can occur when an...

PT-2026-97884

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the madvise cold or pageout pte range function where the pmd trans huge lock mechanism incorrectly handles device-private Page Middle Directories PMDs. When a...

PT-2026-98125

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference can occur in the crypto: ixp4xx component. The chainup buffers function, which creates a linked list of buffer descriptors for a scatterlist, fails to handle...

PT-2026-97941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 entry code where local irq disable is called unnecessarily when exiting to kernel mode. This occurs because the preemption logic expects interrupts to be...

PT-2026-97944

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fs-integrity component of the block layer where the system fails to properly check BIP CHECK flags before generating or verifying Protection Information PI. This...

PT-2026-97945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 module where the make bad inode function is used within ocfs2 read inode block full. Because make bad inode resets the inode type to S IFREG, applying this t...

CVE-2026-93820: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

ROS-20260924-73-0001

The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-97877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client DFS cache where the get tgt name function returns an error pointer when the ce-tgthint variable is NULL. Additionally, the dfs cache noreq update tgthin...

PT-2026-104936

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

SUSE CVE-2026-92162

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

SUSE CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

SUSE CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

kernel: Linux kernel: libceph null pointer dereference leads to denial of service

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service DoS...

kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update

A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...