{"kind": "product", "path": "vulns/ubuntu-22.04-lts/linux", "name": "linux", "product": "linux", "ecosystem": "Ubuntu:22.04:LTS", "items": [{"id": "CVE-2023-7356", "noindex": false, "published": "2026-10-21T14:59:38.724Z", "modified": "2026-10-26T06:55:41.493Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-7356", "title": "Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.", "references": ["https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e", "https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050", "https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98863", "noindex": false, "published": "2026-10-18T15:51:24.446Z", "modified": "2026-10-19T09:26:57.709Z", "cvss": 8.4, "cvss_vector": "", "severity": "high", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98863", "title": "KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path.  If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from the *previous* run of L2, then KVM could\nre-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.\n\nNote, both SVM and VMX (as of commit 11722439fb20 (\"KVM: nVMX: Ensure\nKVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit\") ensure the request\nis cleared on VM-Exit (including the \"forced\" case), i.e. there is no risk\n", "references": ["https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1", "https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8", "https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98862", "noindex": false, "published": "2026-10-18T15:51:23.224Z", "modified": "2026-10-21T12:57:38.560Z", "cvss": 7.1, "cvss_vector": "", "severity": "high", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98862", "title": "audit: fix exe mark UAF in kill_rules()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\n\nKASAN reports:\n\n    BUG: KASAN: slab-use-after-free in audit", "references": ["https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867", "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8", "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98859", "noindex": false, "published": "2026-10-18T15:51:20.456Z", "modified": "2026-10-21T12:57:37.465Z", "cvss": 5.4, "cvss_vector": "", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98859", "title": "HID: multitouch: stop the release timer from being rearmed on remove", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: stop the release timer from being rearmed on remove\n\nmt_remove() quiesces the sticky-finger timer before stopping the\nhardware:\n\n    timer_delete_sync(&td->release_timer);\n\n    sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);\n    hid_hw_stop(hdev);\n\ntimer_delete_sync() waits for a running callback and dequeues the timer,\nbut it does not stop the timer from being armed again. The transport is\nstill delivering reports at that point, and the report path rearms it:\n\n    if (app->quirks & MT_QUIRK_STICKY_FINGERS) {\n        if (td->mt_io_flags & MT_IO_SLO", "references": ["https://git.kernel.org/stable/c/3776f34fbce990af45978f1628d2e1adc0d67d0f", "https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a", "https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98857", "noindex": false, "published": "2026-10-18T15:51:17.262Z", "modified": "2026-10-21T12:57:36.378Z", "cvss": 6.8, "cvss_vector": "", "severity": "medium", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98857", "title": "ipvs: bound LBLCR and LBLC cache growth", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic th", "references": ["https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa", "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300", "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98856", "noindex": false, "published": "2026-10-18T15:51:12.359Z", "modified": "2026-10-21T12:57:35.270Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00169, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98856", "title": "kprobes: Skip disarmed probes when checking optkprobe overlap", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:\n\n              A    A+1  A+2  A+3  A+4\n  A's jump  | e9 | d0 | d1 | d2 | d3 |\n  after C   | e9 | d0 | d1 | d2 | cc |\n\nThe INT3 for C overwrites the last byte of A's jump displacement, so\nexecution can jump to the wrong address. B can have prepared optinsns\nwhile disarmed, but has no jump to unoptimize.\n\nContinue past disarmed and unp", "references": ["https://git.kernel.org/stable/c/3f968dcdf018861129f97910fa7bd680d939a9b0", "https://git.kernel.org/stable/c/985a568171e7bdba6dcde3420d0e5bb515813457", "https://git.kernel.org/stable/c/6745fa65f4115045431c0c15610e876855a04625"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98855", "noindex": false, "published": "2026-10-18T15:51:09.970Z", "modified": "2026-10-21T12:57:34.195Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98855", "title": "of/overlay: put property on deadprops only after changeset add succeeds", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: put property on deadprops only after changeset add succeeds\n\nadd_changeset_property() links a new property of a not-yet-live\ntarget node into the node's deadprops list before handing it to\nof_changeset_add_property(). If that fails, the error path frees the\nproperty but leaves the freed pointer linked in deadprops, and\nof_node_release() frees it a second time when the aborted overlay's\nnode is released.\n\nRecord the changeset entry first and link the property into deadprops\nonly on success. of_changeset_add_property() never looks at the\nnode's property lists, so t", "references": ["https://git.kernel.org/stable/c/936f1ffcb87a1c50938a21176a6463af162cf4b5", "https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a", "https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98854", "noindex": false, "published": "2026-10-18T15:51:06.167Z", "modified": "2026-10-21T12:57:33.107Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98854", "title": "of/overlay: only treat a positive changeset id as registered", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initia", "references": ["https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d", "https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39", "https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98853", "noindex": false, "published": "2026-10-18T15:51:02.683Z", "modified": "2026-10-19T09:26:48.042Z", "cvss": 6.8, "cvss_vector": "", "severity": "medium", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98853", "title": "net: gso: limit recursive IP-in-IP segmentation", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUs", "references": ["https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2", "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763", "https://nvd.nist.gov/vuln/detail/CVE-2026-98853"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98851", "noindex": false, "published": "2026-10-18T15:50:50.910Z", "modified": "2026-10-21T12:57:30.875Z", "cvss": 2, "cvss_vector": "", "severity": "low", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98851", "title": "netfilter: nft_flow_offload: drop flowtable reference on init error path", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get().  When the latter\nfails, the error is returned as-is and the reference is leaked.\n\nThe upper layers do not balance it either: nf_tables_newexpr()\nclears expr->ops when the expression init callback fails, so the\nnft_expr_more() iteration in nft_rule_expr_deactivate() and\nnf_tables_rule_destroy() stops right before the failed expression\nand its ->destroy callback, which would drop the reference, neve", "references": ["https://git.kernel.org/stable/c/1d27214fd9a4d2c0c6d998fc9d4fb61448a3438e", "https://git.kernel.org/stable/c/64ac0cb574c740bf723affb79b646eeba920db6b", "https://git.kernel.org/stable/c/c5f91098edee98c015f78488460a0609e62582a5"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98850", "noindex": false, "published": "2026-10-18T15:50:50.062Z", "modified": "2026-10-21T12:57:29.795Z", "cvss": 5.7, "cvss_vector": "", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98850", "title": "net/packet: prevent TX_RING byte count overflow", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on", "references": ["https://git.kernel.org/stable/c/ae169d318d5d23bac76ece90a7e2b5cb760ed043", "https://git.kernel.org/stable/c/be12b221c0301111eeb023be04add3c6ad7c21fe", "https://git.kernel.org/stable/c/69ca64bbb528898916f309552053c32a04a36ebc"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98847", "noindex": false, "published": "2026-10-18T15:50:40.825Z", "modified": "2026-10-21T12:57:27.585Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98847", "title": "rtc: spear: initialize IRQ state before requesting alarm IRQ", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: spear: initialize IRQ state before requesting alarm IRQ\n\ndevm_request_irq() enables the interrupt before it returns, so the handler\nmay run while probe is still initializing the device. Initialize the MMIO\naddress and spinlock before requesting the alarm IRQ.", "references": ["https://git.kernel.org/stable/c/aeda50d645bbb55241be840602e338b3a16c24ca", "https://git.kernel.org/stable/c/c02aa67ea34a826c2cb1aa65d77cf32fafb7eec3", "https://git.kernel.org/stable/c/e0cabda9b6f4dd276c55c40bdbb251e8507ae60e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98846", "noindex": false, "published": "2026-10-18T15:50:34.714Z", "modified": "2026-10-21T12:57:26.471Z", "cvss": 7.3, "cvss_vector": "", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98846", "title": "sctp: check RCV_SHUTDOWN after the sendmsg connect wait", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err == 0 before checking\nasoc->base.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. ", "references": ["https://git.kernel.org/stable/c/1bef1944ef15a40797305bf916827b04df6307ca", "https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd", "https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98840", "noindex": false, "published": "2026-10-18T15:50:14.029Z", "modified": "2026-10-21T12:57:25.411Z", "cvss": 5.6, "cvss_vector": "", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98840", "title": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() du", "references": ["https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0", "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1", "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98839", "noindex": false, "published": "2026-10-18T15:50:11.869Z", "modified": "2026-10-19T09:26:31.558Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00166, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98839", "title": "vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_", "references": ["https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0", "https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2", "https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98838", "noindex": false, "published": "2026-10-18T15:50:07.004Z", "modified": "2026-10-21T12:57:24.278Z", "cvss": 5.7, "cvss_vector": "", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98838", "title": "vt: skip screen update for DEC alignment test on backgroup consoles", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: skip screen update for DEC alignment test on backgroup consoles\n\n[BUG]\nRecently, we encountered a KASAN warning as follows:\n\nBUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140\nRead of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239\nCPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nCall Trace:\n <TASK>\n ...\n kasan_report+0xf0/0x120\n fb_pad_aligned_buffer+0x11f/0x140\n ccw_putcs+0x86c/0xa80\n fbcon_putcs+0x338/0x410\n do_update_reg", "references": ["https://git.kernel.org/stable/c/2fc4e71aefab57c80ccc9775aad2af503fc90810", "https://git.kernel.org/stable/c/985c000b046ca4ee11ee34ef85db500c569ef6e8", "https://git.kernel.org/stable/c/ad06f7312d3f615dd466483ce81a9b9619166686"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98837", "noindex": false, "published": "2026-10-18T15:50:05.338Z", "modified": "2026-10-21T12:57:23.170Z", "cvss": 7.3, "cvss_vector": "", "severity": "high", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98837", "title": "ALSA: caiaq: unregister the input device when probe fails", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls\nsnd_card_free(), which frees the device state but leaves the input\ndevice registered: card_free() only clears the pointer, and the input\ndevice is unregistered from snd_disconnect() alone. Reading its \"uevent\"\nattribute afterwards dereferences freed memory:\n\n  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0\n ", "references": ["https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d", "https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739", "https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98836", "noindex": false, "published": "2026-10-18T15:49:51.823Z", "modified": "2026-10-21T12:57:22.028Z", "cvss": 7, "cvss_vector": "", "severity": "high", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98836", "title": "ALSA: line6: reject oversized playback packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never\ncompared against it.\n\nsubmit_audio_out_urb() takes the frame count from prev_fsize, which\naudio_in_callback() derived from the *IN* endpoint's received packet\nlength, and rescales it with the playback frame size; when prev_fsize is\nstill zero it synthesizes a length from the sample rate instead.  On a\ndevice declaring a large IN wMa", "references": ["https://git.kernel.org/stable/c/933d8ac23388eb208ea195231d682dce0bec86ca", "https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f", "https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98834", "noindex": false, "published": "2026-10-18T15:49:46.003Z", "modified": "2026-10-19T09:26:26.676Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98834", "title": "mtd: core: avoid double-free of OTP NVMEM device", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: avoid double-free of OTP NVMEM device\n\nIf factory OTP setup fails after the user OTP NVMEM device has been\nregistered, mtd_otp_nvmem_add() unregisters the user device but leaves\nmtd->otp_user_nvmem set. On an error, the caller unregisters it again.\nFor -EOPNOTSUPP, registration continues and normal teardown unregisters\nit again.\n\nClear mtd->otp_user_nvmem after unregistering it.", "references": ["https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb", "https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59", "https://nvd.nist.gov/vuln/detail/CVE-2026-98834"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-98833", "noindex": false, "published": "2026-10-18T15:49:42.181Z", "modified": "2026-10-21T12:57:19.856Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98833", "title": "mtd: core: call _get_device() with the master MTD", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: call _get_device() with the master MTD\n\n__get_mtd_device() calls the master's _get_device() callback with mtd,\nwhich may be a partition. __put_mtd_device() passes the master.\n\nThis breaks gluebi partitions because gluebi_get_device() uses\ncontainer_of() and therefore requires the master MTD. Pass the master\nto _get_device(), matching _put_device().", "references": ["https://git.kernel.org/stable/c/d94731cafa57e2c986ff391122d1494e5a3f3c3f", "https://git.kernel.org/stable/c/95c8f36293c22d450c371167ad4f9a5bbadc7539", "https://git.kernel.org/stable/c/f971f1c63cf71579258360a12bd185bc1cd1a043"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}]}], "total": 10765, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/ubuntu-22.04-lts/linux", "ecosystem": "Ubuntu:22.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 401, "kev": 0}, "lastmod": "2026-10-26T06:55:41.493Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}