PT-2026-90229

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT GET INFO stores guest-controlled num events sizeofeinfo in a 32-bit integer. On RV64, num events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates...

PT-2026-90525

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

PT-2026-90054

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

PT-2026-90005

🚨 CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the...

PT-2026-89880

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

PT-2026-90430

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation hash table leak when nfs4 server common setup fails nfs4 server common setup allocates server-delegation hash table first, but server-destroy - the only path that frees the table via nfs4 destroy server - is n...

PT-2026-89864

🚨 AI INFRA CRISIS: SGLang just got hit with an unauthenticated RCE CVE-2026-86793 — the 4th critical CVE in AI infrastructure in just 18 days. No vendor patch yet. AI inference servers are now primary attack surface. Time to audit your stack. AI cybersecurity infosec...

PT-2026-90203

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

PT-2026-90101

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000 free usb related resources frees both URBs and leaves the pointers behind: usb kill urbbcd2k-midi out urb; usb kill urbbcd2k-midi in urb; usb free urbbcd2k-midi out urb;...

PT-2026-90207

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb live lock in o2hb region pin Patch series "ocfs2: cluster: o2hb region pin fixes", v2. This series fixes three related issues in o2hb region pin, all are from the original...

PT-2026-90401

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients still reclaiming clients still reclaiming computes a deadline from nn-boot time CLOCK REALTIME, 1.7 billion but compares it against ktime get boottime seconds CLOCK BOOTTIME, seconds sin...

PT-2026-90445

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor hub get feature sensor hub get feature clamps its return value to the caller's buffer size, but the copy loop still copies field-report size / 8 bytes for each report value. A...

PT-2026-90471

In the Linux kernel, the following vulnerability has been resolved: mm/migrate device: clear stale mapping after freeing swapcache migrate device pages reads the folio mapping before calling folio free swap. When folio free swap succeeds, the folio is removed from the swap cache, but the saved...

PT-2026-90266

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth gss: enforce krb5 token minimum length svcauth gss unwrap priv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss unwrap: if len xdr stream remainingxdr goto unwrap...

PT-2026-90242

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr count read segments checks only 4-byte...

PT-2026-90171

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda pcie irq domain deinit removes pcie-event domain via irq domain remove, but the per-event IRQs mapped from that domain are requested with devm request irq in plda...

PT-2026-90104

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501 devdata in sm501 pci probe and sm501 plat probe is not freed by the corresponding remove functions sm501 pci remove and sm501 plat remove...

PT-2026-90075

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req-dst with the CPU while it is still mapped DMA FROM DEVICE. With...

PT-2026-90142

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp get string from buffer hp get string from buffer clamps the converted string length against the destination buffer size with "size dst size", so when the converted length is...

PT-2026-90385

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4 copy notify finished initializing the cpntf state after nfs4 alloc init cpntf state had already linked it into the s2s cp stateids IDR and the parent's sc cp list,...

PT-2026-90289

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array block check can only compare the header against itself, so a block with value size 4 and max entries 1018 is internally consistent and passes. dm-cache...

PT-2026-90360

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfs dio iomap begin calls btrfs get extent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range, btrfs get bloc...

PT-2026-90376

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4 client; a stateid reference does not pin it. The client survives only because destroy client drains its stateids...

PT-2026-90466

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Clear copied tracing state before fork duplication dup task struct copies user event mm from the parent into the child, without grabbing a reference to it. user event mm dup should replace it, but it leaves...

PT-2026-90478

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin current label crit section AppArmor's begin current label crit section is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label...

PT-2026-90487

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace buffer subbuf size is read lockless in ring buffer read page and ring buffer read start, while it can simultaneously be resized with ring buffer subbuf order set...

PT-2026-90541

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

PT-2026-89766

In PCRE2 before 10.48, pcre2 jit match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

PT-2026-90061

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1 f19 i2c master transfer is the master xfer for the DS28E17 1-Wire to I2C bridge. On an I2C M RECV LEN read, it takes the length from the device. The downstream slave...

PT-2026-90068

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615 suspend acquired the mt76 mutex and then called cancel delayed work sync on mac work. mt7615 mac work acquires the same mutex via mt7615 mutex acquire at...

PT-2026-90072

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du init sw vars The memory allocated inside rtl92du init shared data is not freed in any of the subsequent error paths in rtl92du init sw vars. Fix that by adding a call ...

PT-2026-90093

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm kvzallocpercpu alloc size, cpu to nodecpu" fails, the code jumps to the "out" label and calls dm stat free. dm stat free does "for each possible cpucpu dm...

PT-2026-90096

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This...

PT-2026-90131

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl sync slip devs stores bare net device pointers and takes no reference on them. sl sync and sl alloc walk that table from slip open under rtnl lock, while an entry is dropped by sl free netdev, which...

PT-2026-90143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...

PT-2026-90158

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos assoc ioctl isst if clos assoc validates the user-supplied socket id with 'socket id topology max packages', but isst common.sst inst is allocated with topology max packages entries,...

PT-2026-90187

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros usbpd-charger: bound the EC-reported port count cros usbpd charger probe reads two port counts from the EC and uses one of them, num charger ports, as the loop bound when populating a fixed-size array: struct...

PT-2026-90196

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

PT-2026-90200

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt locks init private installs NLM file lock operations even when nlmclnt find lockowner fails to allocate a lockowner. nlmclnt proc then returns -ENOMEM, but the V...

PT-2026-90201

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm inspect file lock-drop nlm traverse files pins the current file with f count++ across a mutex unlock for nlm inspect file, but nothing pins the saved next pointer. A concurrent nlm release file can...

PT-2026-90281

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect md mode when metadata dst allocation fails In collect md mode ipip tunnel rcv returns 0 without freeing the skb when ip tun rx dst fails to allocate the metadata dst. ipip rcv and mplsip rcv are...

PT-2026-90325

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs exorcise daemon drops queued messages from a dying daemon without holding ecryptfs msg ctx lists mux, but ecryptfs msg ctx alloc to free requires that lock. Tak...

PT-2026-90077

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx urb wq on stop rtl8xxxu arms rx urb wq from the RX completion path: rtl8xxxu rx complete hands the URB to rtl8xxxu queue rx urb, which queues it on rx urb pending list and, once the list...

PT-2026-89850

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD Server/VMAP.php, which is reachable without authentication when the AD Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset...

PT-2026-90447

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl rch get aer info out-of-bounds AER register read cxl rch get aer info copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aer capability regs. This...

PT-2026-90321

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs send message locked moves a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs send miscdev fails, t...

PT-2026-90392

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s cp stateids IDR entry for async COPY For an async COPY, nfsd4 copy called nfs4 init copy state before dup copy fields, so the s2s cp stateids IDR was pointed at &u-copy-cp stateid -- memory in the per-rqstp...

PT-2026-90378

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroy client releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on cl ownerstr hashtbl. client has state does not...

PT-2026-90119

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnet connected work undoes its own work and returns without clearing login sent, so the connection still looks established. The next tbne...

PT-2026-90341

In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl poke timer / ghl urb at driver unbind For GHL Guitar Hero Live dongles, sony probe arms a periodic timer: ghl magic poke the timer callback submits sc-ghl urb, and the URB completion ghl magic poke cb...