CVE-2022-4994

CVE-2022-4994 concerns a Linux kernel KVM/x86 issue where the fast IN path for in-kernel PIO was adjusted. The change routes fast PIO through __emulator_pio_in() directly instead of bouncing via emulator_pio_in(), since __emulator_pio_in() now fills the required value and vcpu->arch.pio.count ...

USN-8620-2 linux-azure-fips vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

CVE-2026-42493 x86 shadow paging is deprecated

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

CVE-2026-42493

XEN CVE-2026-42493 involves x86 shadow paging. The XSA advisory states the feature is deprecated due to costly preemption handling, with alternatives (HVM/PVH: HAP, PV: shim) available, though retained for security-risk use. Affects all x86 Xen builds with SHADOW_PAGING=y; unprivileged guests may...

USN-8620-1: Linux kernel vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8595-3 linux-aws-6.8, linux-aws-fips vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

USN-8574-3: Linux kernel vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

CVE-2026-64477

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

CVE-2026-64513

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

CVE-2026-64302

Summary: CVE-2026-64302 affects the Linux kernel in the x86 memory management code. The root issue is that pagetable_free() was used to free PMD-sized vmemmap pages, but vmemmap pages are not page tables, causing only the first page to be freed and leaking the rest. This was triggered by a commit...

CVE-2026-64284

CVE-2026-64284 — Linux kernel (KVM/x86): The vulnerability involves moving the handling of fastpath userspace exits into vendor code so KVM can run vendor-specific operations before userspace gains control of the vCPU. The description notes that, for VMX (and soon SVM), KVM must flush the PML buf...

CVE-2026-64284 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

DEBIAN-CVE-2026-64247

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank the TLFS allows for a maximum o...

CVE-2026-64235

CVE-2026-64235 refers to a Linux kernel issue where, on x86 with CONFIG_CALL_DEPTH_TRACKING and retbleed protections (e.g., Skylake), relocating percpu references for dynamic ftrace trampolines caused a crash on the first call to a traced function. The crash was due to a mis relocation of the CAL...

USN-8609-1 linux-azure-fde-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8604-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8597-1: Linux kernel (IBM) vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8596-1: Linux kernel (NVIDIA) vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...