USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8604-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

PT-2026-71709

Name of the Vulnerable Software and Affected Versions Hub versions prior to 0.2.16 Description Unauthenticated WebSocket connections trigger the loadDefaultConnectionEventListeners function to call requestClientId, which subsequently executes rpc.send for the get-client-id action and adds a reque...

RockyLinux 9 : kernel (RLSA-2026:43307)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:43307 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final...

CVE-2026-10675

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675

Zephyr Project Bluetooth Mesh PB-ADV vulnerability (CVE-2026-10675) in prov_msg_recv() reschedules the provisioning watchdog timer unconditionally at the top of the function, before FCS and ADV_LINK_INVALID checks. If a provisioning attempt fails (ADV_LINK_INVALID set), a malicious, unauthenticat...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

SUSE CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

SUSE CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

SUSE CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64093

A flaw was found in the batman-adv component of the Linux kernel. A race condition exists where a timer can be re-armed after its associated reference has been removed during cleanup. This can occur when batadvtpsendercleanup attempts to shut down a timer, but a separate execution context re-arms...

PT-2026-62123

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pb adv.c, prov msg recv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV LINK INVALID check. Once a provisioning attempt fails, prov...

The vulnerability of the mptcp_pm_del_add_timer() function in the net/mptcp/pm.c module of the MPTCP protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mptcppmdeladdtimer function in the net/mptcp/pm.c module of the MPTCP protocol implementation in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

MAL-2026-10892 Malicious code in claude-code-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...

Malicious code in claude-code-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...

hdlc_ppp: sync per-proto timers before freeing hdlc state

...

Linux Distros Unpatched Vulnerability : CVE-2026-64093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer...

SUSE CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...