RockyLinux 8 : webkit2gtk3 (RLSA-2026:84584)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:84584 advisory. chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-21838)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal devicedel can lead to new work being scheduled in gadget-work workqueue. This is observed, for example, with the dwc3 driver with the following call stack: devicedel...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53198)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL A deferred byte-range lock an SMB2LOCK that blocks registers an async work on conn-asyncrequests via setupasyncwork, with cancelfn = smb2removeblockedlock and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43074)

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, epfree in eventpoll.c will kfree the epi-ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree to an RCU...

Linux Distros Unpatched Vulnerability : CVE-2026-98580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and...

Siemens SIMATIC S7-1500 TM MFP Time-of-check Time-of-use (CVE-2026-46227)

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctpsendmsgtoasoc in SCTPSENDALL The SCTPSENDALL path in sctpsendmsg iterates ep-asocs with listforeachentrysafe, which caches the next entry in @tmp before the loop body runs. The body calls...

Oracle Linux 10 : kernel (ELSA-2026-76738)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76738 advisory. - netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state CKI Backport Bot RHEL-271653 CVE-2026-93288 - tcp: fix stale per-CPU...

CentOS 9 : kernel-5.14.0-757.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-757.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access ...

intel_crtc_put_color_blobs() Function Kernel Module Use-After-Free

The vulnerability of the intelcrtcputcolorblobs function in the drivers/gpu/drm/i915/display/intelatomic.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

PT-2026-117968

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via ImagingLibTiffEncode in src/libImaging/TiffDecode.c when a libtiff encode error occurs. The cleanup logic in the error path frees or closes TIFF resources calling TIFFCleanup/TIFFClose or freeclientstate-data without...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via ImagingScaleAffine in src/libImaging/Geometry.c, which deletes a caller-owned output image when its lookup-table allocation fails. When resize calls ImagingTransform and the internal affine transform encounters a memo...

Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable via fontrenderimpl in src/imagingft.c, where a FTGlyph object can be freed via FTDoneGlyph during the rendering loop when a stroker is active, and then freed a second time in the glypherror cleanup path due...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the TIFF strip and tile decoder in src/libImaging/TiffDecode.c, when decoding TIFF images using codecs such as JPEG or Group 4 that successfully decode fewer rows than the declared strip or tile length...

Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable in the topalette function in src/libImaging/Convert.c when quantize is called with an empty palette. An attacker can trigger an unhandled error condition by supplying a palette with zero entries, causing th...

SUSE CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

SUSE CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

SUSE CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

SUSE CVE-2026-98752

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

SUSE CVE-2026-98757

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...