UBUNTU-CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64261

A flaw was found in the Linux kernel's fuse-uring component. This use-after-free vulnerability allows a local attacker to potentially achieve privilege escalation. The issue arises when the fuseuringasyncstopqueues function attempts to access memory that has already been freed, leading to...

UBUNTU-CVE-2026-64261

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

UBUNTU-CVE-2026-64438

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

CVE-2026-64438

Summary of CVE-2026-64438 : In the Linux kernel’s crypto: qat path, a race during VF2PF teardown could cause use-after-free of per-VF state (vf_info) due to tearing down per-VF locks and state before in-flight VF2PF work completes. The fix introduces a PF-local flag (vf2pf_disabled) that gates wo...

CVE-2026-64425 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64261 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

PT-2026-64482

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse-uring component. The function fuse uring async stop queues may execute after the final reference on the ring-queue refs variable has been droppe...

PT-2026-64646

In the Linux kernel, the following vulnerability has been resolved: io uring/io-wq: re-check IO WQ BIT EXIT for each linked work item commit 10dc95939817 "io uring/io-wq: check IO WQ BIT EXIT inside work run loop" fixed the obvious case where io worker handle work took one exit-bit snapshot befor...

PT-2026-64631

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: IPIP tunnel hardware offload is not yet support No driver supports for IPIP tunnels yet, give up early on setting up the hardware offload for this scenario. This patch adds a stub that can be enhanced to add...

PT-2026-64659

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf disable sriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adf accel vf info. Currently, adf disable sriov destroys...

EUVD-2026-47231

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Non-Media Integration issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47051

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: UWQ Server Issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal...

CVE-2026-60997

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Non-Media Integration issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-60701

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to...

SUSE CVE-2026-64206

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx takes the same mutex, so teardown can deadlock against the worker it is...

PT-2026-62728

Name of the Vulnerable Software and Affected Versions Oracle Universal Work Queue versions 12.2.3 through 12.2.15 Description An issue in the UWQ Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires human interaction from...

EUVD-2026-45591

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-53308 power: supply: max77705: Free allocated workqueue and fix removal order

In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Free allocated workqueue and fix removal order Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove, because the workqueue is not destroyed. 2...

CVE-2026-53100

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix deadlock in remain-on-channel mt76remainonchannel and mt76roccomplete call mt76setchannel while already holding dev-mutex. Since mt76setchannel also acquires dev-mutex, this results in a deadlock. Use mt76setchann...