DEBIAN-CVE-2026-98653

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...

AZL-109152 CVE-2026-98668 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98653

The Linux kernel contains a vulnerability within the KVM s390 subsystem. Specifically, in certain circumstances, a page of nested guest memory being shadowed may be missing from the parent guest gmap . This causes dat_entry_walk() to fail to find a leaf entry and return -ENOENT , which is then er...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: initialize registers in nftdochain The registers were initialized to prevent a stack leak into the user space...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

An integer overflow flaw was discovered in the Linux kernel. This issue causes the kernel to allocate skbsharedinfo in the user space, which can be exploited in systems without SMAP protection, as skbsharedinfo contains references to function pointers...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Anonymous sets are never used with a timeout flag; therefore, this behavior is disallowed. An exception to this rule applies for NFTSETEVAL, to ensure that legacy metering mechanisms continue to work properly...

CVE-2026-101311 Multiple vulnerabilities in bhyve device models

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101311

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101311

The bhyve hypervisor contains multiple vulnerabilities in its device models, specifically affecting the framebuffer device model. The issue stems from duplicated and desynchronized maximum resolution constants between the framebuffer and RFB modules. Additionally, the framebuffer BAR allows write...

CVE-2026-101311 Multiple vulnerabilities in bhyve device models

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

EUVD-2026-101931

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101309

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101311: Concurrent Execution using Shared Resource with Improper Synchronization

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101309: Concurrent Execution using Shared Resource with Improper Synchronization

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

PT-2026-114820

Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The xHCI USB 3 device model fails to validate or save the event ring size provided by the guest. Because the size is re-read from guest memory during each use, Transfer Request Block TRB fields...

CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-90324

A flaw was found in the ublk component of the Linux kernel. A local attacker, by providing an invalid address range from a userspace ublk server, could cause the importubuf function to fail. This failure, if not properly handled, leads to an uninitialized data structure being used in subsequent...

CVE-2026-90139

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE subsystem. When the fuseiget function fails to allocate an inode, such as under memory pressure, the subsequent fusefillsupersubmount function does not properly handle the returned null value. This oversight can lead to a null...