CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

EUVD-2026-49002

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-64280

The CVE concerns the Linux kernel’s FPGA driver for DFL FPGA management (fpga: dfl-afu). A 64-bit length passed via the DFL_FPGA_PORT_DMA_MAP ioctl to afu_ioctl_dma_map() can overflow when computing the number of pages (length >> PAGE_SHIFT) passed to pin_user_pages_fast(), since npages is ...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

PT-2026-64501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where afu ioctl dma map accepts a 64-bit length from userspace via the DFL FPGA PORT DMA MAP ioctl without an upper bound check. This value is passed to afu dma pin pages...

Linux Distros Unpatched Vulnerability : CVE-2026-13057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the server's Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and...

PT-2026-64485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fuse-uring component where the fuse uring commit function incorrectly handles failures during memory copying. When copy from user fails, it returns a positive...

PT-2026-64670

In the Linux kernel, the following vulnerability has been resolved: staging: vme user: bound slave read/write to the kern buf size The SLAVE-path helpers buffer to user and buffer from user copy 'count' bytes into/out of the fixed-size kern buf size buf == PCI BUF SIZE == 0x20000, 128 KiB using...

Linux Distros Unpatched Vulnerability : CVE-2026-17039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path...

Linux Distros Unpatched Vulnerability : CVE-2026-59677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processe...

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct...

Linux Distros Unpatched Vulnerability : CVE-2026-64324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops th...

PT-2026-64613

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...

PT-2026-64511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd fault fops read function where a failure in copy to user within an inner list for each entry loop only breaks the inner loop. This causes the outer while...

CVE-2026-61892

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-61886

Weintek cMT3092X HMI stores user account passwords in plaintext...

CVE-2026-16280

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in...

GHSA-J6G5-3HH3-PGW8 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...