CVE-2026-50079

Time-of-check Time-of-use TOCTOU Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM...

EUVD-2026-122655

Time-of-check Time-of-use TOCTOU Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM...

CVE-2026-50079

A Time-of-check Time-of-use (TOCTOU) Race Condition exists in the virtio network virtual device within the QNX Virtual Machine (QVM) . This vulnerability affects QNX Hypervisor and QNX Hypervisor for Safety . An attacker operating within the guest environment could manipulate the virtual network ...

PT-2026-144432

Time-of-check Time-of-use TOCTOU Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xhci: Device endpoints are removed from the bandwidth list when the device is freed. Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If the xHCI host is dying or bein...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098966 advisory. In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix detach procedure for virtual devices in genpd If a device is attached to a PM...

CVE-2026-64331

CVE-2026-64331 is a NULL pointer dereference in the Linux kernel's usbip vudc subsystem. The root cause is that vep_alloc_request() never initialized vrequest->udc, so when FunctionFS AIO cancellations arrived in vep_dequeue, a NULL UDC reference caused a kernel oops. The bug reportedly existe...

SUSE CVE-2026-63990

In the Linux kernel, the following vulnerability has been resolved: bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in canrxunregister inside net/can/afcan.c. The crash occurs because a virtual CAN device vxcan is being enslaved to a bonding master. During the...

CVE-2026-46292

A flaw was found in the Linux kernel's generic power domain genpd component. When a virtual device is detached from a power management PM domain, the pmruntimedisable function is not called, leaving runtime PM enabled for the detached device. This oversight can lead to critical errors, including ...

CVE-2026-46292 pmdomain: core: Fix detach procedure for virtual devices in genpd

In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix detach procedure for virtual devices in genpd If a device is attached to a PM domain through genpddevpmattachbyid, genpd calls pmruntimeenable for the corresponding virtual device that it registers. While this...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the process of virtual device separation in genpd, and it may lead to null pointer dereferencing...

PT-2026-44091

pam usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event nodes, causing pusb has virtual input device to return 0 no virtual devices found even when every open call failed due to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fixed a memory leak in kvmipidestroy In kvmioctlcreatedevice, kvmdevice has allocated memory. kvmdevice-destroy seems to be supposed to free up the kvmdevice structure, but kvmipidestroy does not do this currently...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021543)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021543 advisory. In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device endpoints from bandwidth list when freeing the device Endpoints are normally...

SUSE CVE-2026-31724

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: feem: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, t...

SUSE CVE-2026-31725

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fecm: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, t...

CVE-2026-31724 usb: gadget: f_eem: Fix net_device lifecycle with device_move

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: feem: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, t...

CVE-2026-31724 usb: gadget: f_eem: Fix net_device lifecycle with device_move

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: feem: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, t...

CVE-2026-31722 usb: gadget: f_rndis: Fix net_device lifecycle with device_move

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds,...

EUVD-2026-26535

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Fix netdevice lifecycle with devicemove The netdevice is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds,...