PT-2026-97932

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AppArmor component where list heads in policy int may not be properly initialized if profile creation fails before policy init is completed. This failure causes...

PT-2026-104945

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 device links no driver+0xcc/0xfc...

CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97501

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrlgpiodirectioninput / pinctrlgpiodirectionoutput take the pinctrl mutex. This causes a gpiochip operations to need to sleep. Worse yet, the .cansleep...

CVE-2026-93275

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

SUSE CVE-2026-92479

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...

CVE-2026-95754

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-95754 MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-95754: Improper Authorization

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

PT-2026-96784

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotp counter. When the TOTP...

SUSE CVE-2026-90218

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...

SUSE CVE-2026-92485

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to a tailcallreachable prog. 'tr-flags' became 'BPFTRAMPFCALLORIG |...

SUSE CVE-2026-93113

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCCGDSCCLK With the introduction of syncstate support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: 15.408367...

Linux Distros Unpatched Vulnerability : CVE-2026-90232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1...

Linux Distros Unpatched Vulnerability : CVE-2026-90067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client...

Linux Distros Unpatched Vulnerability : CVE-2026-92485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to...

Linux Distros Unpatched Vulnerability : CVE-2026-90190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsyst...

Linux Distros Unpatched Vulnerability : CVE-2026-90360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to r...

Linux Distros Unpatched Vulnerability : CVE-2026-90157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The...

DEBIAN-CVE-2026-93140

In the Linux kernel, the following vulnerability has been resolved: udf: Mark LVID buffer as uptodate before marking it dirty When an I/O error occurs while writing the Logical Volume Integrity Descriptor LVID buffer to the block device, the block layer's completion handler endbufferwritesync...