Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.25. It arises because the memstick core uses waitforcompletiontimeout in memstickalloccard and memsticksetrwaddr to wait for completion of device identification and address configuration requests. After a timeout, the memstickdev structu...

PT-2026-121899

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 nested virtualization implementation regarding the life cycle of the nested mmus array, which stores shadow page tables used during nested contexts. When...

PT-2026-121992

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where rebinding an HCI socket after its controller is unregistered can lead to a race condition with monitor control replay, potentially crashi...

PT-2026-121983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915/gem component where the eb relocate parse slow function can overstep the exec array boundary. This occurs when eb copy relocations allocates copies for ex...

PT-2026-121866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the thunderbolt component. Hotplug events are processed in a workqueue that can execute after the domain has been removed by the tb domain remove...

ALSA-2026:A011 Important: php:7.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ALSA-2026:A012 Important: php:7.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

MiracleLinux 9 : php:8.1 (AXSA:2026-2127:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2127:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

RHEL 8 : php:7.4 (RHSA-2026:88533)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88533 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

MiracleLinux 8 : php:7.2 (AXSA:2026-2132:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2132:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Linux Distros Unpatched Vulnerability : CVE-2026-99035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does no...

Important: php:8.0 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

Curl 8.12.0 < 8.23.0 HTTP/2 Upload Use-After-Free

The version of curl installed on the remote host is 8.12.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a stru...

RHEL 9 : thunderbird (RHSA-2026:85244)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85244 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

RockyLinux 9 : thunderbird (RLSA-2026:80694)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80694 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component...

ALSA-2026:A014 Important: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

Linux Distros Unpatched Vulnerability : CVE-2026-98937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users ca...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_87073)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687073 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and R...

Linux Distros Unpatched Vulnerability : CVE-2025-60482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause...

MiracleLinux 9 : php:8.3 (AXSA:2026-2128:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2128:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...