Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound [CVE-2026-42959]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound, due to a flaw in the DNSSEC validator that can lead to a crash given malicious upstream replies. CVE-2026-42959. NLnet Labs Unbound is used in our service speech utilities. This vulnerability...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed an issue where an uninitialized pointer was passed to auditloguntrustedstring. Commit 4a134723f9f1 “AppArmor: moved the check for aanull file to cover all cases”. It corrected a minor bug where pathname might...

The vulnerability of the JavaScript Engine component in web browsers Firefox ESR, Firefox, and the email client Thunderbird allows a hacker to trigger a service failure.

The vulnerability of the JavaScript Engine component in Firefox ESR, Firefox, and the Thunderbird email client relates to access to an uninitialized pointer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the fs/ntfs3 component in the Linux operating system allows a hacker to gain access to confidential data.

The vulnerability of the fs/ntfs3 component in the Linux operating system is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102027)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102027 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation...

CVE-2026-74286

A flaw was found in the Linux kernel's Packet Forwarding Control Protocol PFCP module. The module fails to properly allocate per-CPU statistics, leaving a pointer uninitialized. A local attacker can exploit this by creating a PFCP rtnetlink device, which triggers a null pointer dereference. This...

CVE-2026-16827 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer...

CVE-2026-72455

A flaw was found in the AppArmor security module of the Linux kernel. A bug in the pathname function, related to handling aanull files, may cause an uninitialized pointer to be passed to aaauditfile. This can lead to a kernel page fault, resulting in a system crash and a Denial of Service DoS for...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102688)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102688 advisory. libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap...

The vulnerability of the iccdebugfs_client_init() function in the drivers/interconnect/debugfs-client.c module of the Linux kernel’s interconnection driver allows a attacker to cause a service failure.

The vulnerability of the iccdebugfsclientinit function in the drivers/interconnect/debugfs-client.c file of the Linux kernel’s interconnection driver module relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the wm97xx_battery.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the wm97xxbattery.c component in the Linux operating system is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability in the drivers/hid/hid-pl.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/hid/hid-pl.c component in the Linux operating system is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099702)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099702 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation...

MINI-MCRF-QMXP-VRH6

Bulletin has no description...

UBUNTU-CVE-2026-74552

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo has been called. At that time, data-hwmondev is not y...

CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

UBUNTU-CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

CVE-2026-72455

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 "apparmor: move check for aanull file to cover all cases" intrdouced a small bug, where pathname may pass a potentially uninitialized name ...

CVE-2026-68461

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...

CVE-2026-72455

The CVE-2026-72455 entry concerns the Linux kernel’s AppArmor path handling. A bug was introduced where path_name() could pass a potentially uninitialised name to aa_audit_file(), if the path’s dentry had been replaced with aa_null.dentry, triggering an audit path that could lead to a kernel page...