virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

openSUSE 16: kubevirt1.9-container-disk / kubevirt1.9-libguestfs-tools / etc (openSUSE-SU-2026:22180-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22180-1 advisory. - CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host bsc1272840. - CVE-2026-78659:...

Security update for kubevirt1.9 (important)

openSUSE security update: security update for kubevirt1.9 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22180-1 Rating: important References: bsc1272840 bsc1285255 bsc1286984 bsc1287039 bsc1287143 bsc1287446 Cross-References: CVE-2026-13622...

OPENSUSE-SU-2026:22180-1 Security update for kubevirt1.9

This update for kubevirt1.9 fixes the following issues: - CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host bsc1272840. - CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers bsc1286984. - CVE-2026-78660:...

CVE-2026-113496 Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-113496

A vulnerability exists in cockpit-machines where VNC console passwords are disclosed via command-line arguments. When saving settings, the software passes the password directly to an underlying system utility. A local unprivileged attacker capable of cross-user process inspection can read this pa...

CVE-2026-113496 Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

Linux Distros Unpatched Vulnerability : CVE-2026-98841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: remove SETNETDEVDEV to avoid use-after-free Currently, we execute SETNETDEVDEVdev, &priv-lowerdev-dev for the virtwifi network devices. However, unregistering a virtwifi device in netdevruntodo can occur...

SUSE CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

DEBIAN-CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

UBUNTU-CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

EUVD-2026-103781

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841

The Linux kernel contains a vulnerability in the virt: vmgenid component where notification handlers are registered before driver_data is assigned. This improper ordering causes a kernel NULL pointer dereference and a system panic if an interrupt or ACPI notification occurs during the probe path....

PT-2026-117060

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmgenid driver where notification handlers are registered before the driver data variable is assigned. In the devicetree path, an interrupt can be triggered...