Linux Distros Unpatched Vulnerability : CVE-2026-72380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it ...

PT-2026-72891

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

PT-2026-72950

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill max is set When a USB audio endpoint requests full packet transfers via the fill max descriptor flag, data ep set params promotes ep-curpacksize to ep-maxpacksize...

PT-2026-72190

In the Linux kernel, the following vulnerability has been resolved: memstick: ms block: reject a card that reports too many blocks msb ftl initialize computes the zone count from the card block count with no bound: msb-zone count = msb-block count / MS BLOCKS IN ZONE; ... for i = 0; i zone count;...

PT-2026-72203

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv dless read receives a P DATA REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data size,...

PT-2026-72378

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mrec lock ABBA deadlock in rename ntfs file fsync, ntfs dir fsync and ntfs write inode lock an inode's mrec lock before taking the mrec lock of its parent directory. ntfs rename takes old ni-mrec lock and old dir ni-mre...

PT-2026-72626

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending and barrier reference leaks on discard failures raid10 make request acquires a writes pending reference with md write start before calling raid10 handle discard. Several failure paths in raid10 handl...

PT-2026-72466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gue...

PT-2026-72384

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copy lcns dp-page lcns index in analysis pass In log replay's analysis pass, after find dp returns a valid DIR PAGE ENTRY for the target attr, target vcn tuple, the copy lcns block walks lrh-lcns follow further...

PT-2026-72405

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr buf to bvec stores before writing xdr buf to bvec writes a bio vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When th...

PT-2026-72333

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem write In mem write, the temporary array returned by parse int array user must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so i...

PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

PT-2026-72742

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f pos race in qat vf resume write qat vf resume write checks filp-f pos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurre...

PT-2026-73060

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

Linux Distros Unpatched Vulnerability : CVE-2026-72338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actpedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and...

Linux Distros Unpatched Vulnerability : CVE-2026-74487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write...

Linux Distros Unpatched Vulnerability : CVE-2026-72423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks onl...

PT-2026-72440

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft set pipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nft pipapo match can enter a bad state: - some fields can have their lookup tables resized while others did not - bit...

PT-2026-72798

In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of generic write sync Fix ext2 dio write iter to propagate the error returned by generic write sync instead of silently discarding it, which could cause write2 to return success to userspace on O...

PT-2026-72634

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle uaudio stream req resolves an interface index with info idx from ifnum, which returns -EINVAL when no interface matches. The enable branch and the...