EUVD-2026-108893

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98921

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the ovl_do_mkdir() function within the overlay filesystem component. The issue occurs because the function prints the input dentry using %pd after calling vfs_mkdir(). Since a recent change in vfs_mkdir() causes it to call end_crea...

CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618 Use...

SUSE-SU-2026:24382-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files bsc1271044. - CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory bsc1271046. -...

Security update for openssh

This update for openssh fixes the following issues: CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files bsc1271044. CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory bsc1271046. CVE-2026-59997:...

Important: Red Hat Security Advisory: php security update

An update for php is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CVE-2026-98896

The Linux kernel contains a vulnerability in the thunderbolt driver where hotplug events are processed in a workqueue. This can lead to a Use-After-Free (UAF) condition if the domain is removed via tb_domain_remove() (e.g., during a driver unload) while the tb_handle_hotplug() handler is still sc...

CVE-2026-98896 thunderbolt: Keep the domain reference while processing hotplug

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

EUVD-2026-108690

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98896 thunderbolt: Keep the domain reference while processing hotplug

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98870 ksmbd: remove stale channels from all sessions on teardown

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

CVE-2026-98870

The Linux kernel contains a use-after-free vulnerability within the ksmbd component. The issue arises because ksmbd_sessions_deregister() only removes a connection's channels from other sessions if the conn->binding flag is set. Since conn->binding is a transient flag cleared during certain...

EUVD-2026-108716

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

CVE-2026-98870 ksmbd: remove stale channels from all sessions on teardown

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell toolkit — research release Tooling for CVE-2026-1...

CLSA-2026-1792753768 Fix of 29 CVEs

CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group CVE-2026-74480 CVE-2026-74581 - net: ipv6: clear suppressed fib6 rule result CVE-2026-74581 CVE-2026-80714 - ipvs: do not propagate one-packet flag to synced conns CVE-2026-80714 CVE-2026-43503 - net: skbuff: propagate...