{"kind": "product", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "name": "linux-oracle", "product": "linux-oracle", "ecosystem": "Ubuntu:26.04:LTS", "items": [{"id": "CVE-2026-99099", "noindex": false, "published": "2026-10-26T14:52:04.997Z", "modified": "2026-10-26T14:52:04.997Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99099", "title": "x86/CPU/AMD: Fix AMD TLBI Erratum #1718", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Fix AMD TLBI Erratum #1718\n\nThe processor may fail to invalidate a TLB entry while executing an\nINVLPGB/TLBSYNC instruction pair.\n\nDetect the erratum and apply a software workaround when a microcode fix\nis not present.", "references": ["https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe", "https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6", "https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99098", "noindex": false, "published": "2026-10-26T14:52:04.416Z", "modified": "2026-10-26T14:52:04.416Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99098", "title": "dm-integrity: fix buffer overflow in inline mode with large tag size", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow in inline mode with large tag size\n\nIn inline mode, dm_integrity_check and dm_integrity_inline_recheck\ncompute the checksum of each block into an on-stack buffer of\nHASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result\nwith zeroes up to the tag size, so if the tag size is larger than\nHASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With\nCONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the\nfirst read.\n\nEnlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5\n(\"dm integrity: fix a ", "references": ["https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86", "https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165", "https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99097", "noindex": false, "published": "2026-10-26T14:52:03.824Z", "modified": "2026-10-26T14:52:03.824Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99097", "title": "tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()\n\ntee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size\nand passes it to alloc_pages_exact() without checking it. For size == 0\nnr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is\ndocumented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page\nallocator then trips its order > MAX_PAGE_ORDER warning and fails the\nallocation; on a panic_on_warn kernel that ends the boot.\n\nThis can be triggered by TEE_IOC_SHM_ALLOC with struct\ntee_ioctl_shm_alloc_data where size is 0", "references": ["https://git.kernel.org/stable/c/e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d", "https://git.kernel.org/stable/c/65cb86860a80ffc6af897d53f5bd4b1733bca0ec", "https://git.kernel.org/stable/c/c2a97703359e25ec7ef8b2b0ef32fb3982add90a"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99096", "noindex": false, "published": "2026-10-26T14:52:03.236Z", "modified": "2026-10-26T14:52:03.236Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00152, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99096", "title": "io_uring/register: don't exempt disabled rings from task restrictions", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/register: don't exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can there", "references": ["https://git.kernel.org/stable/c/f55c240192ded562386de843bfa067671d2731d5", "https://git.kernel.org/stable/c/6da8f402e362b2f546e2efb7167fc9597aef6faf", "https://nvd.nist.gov/vuln/detail/CVE-2026-99096"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99095", "noindex": false, "published": "2026-10-26T14:52:02.647Z", "modified": "2026-10-26T14:52:02.647Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99095", "title": "drm/vc4: drain the hangcheck timer and works on V3D unbind", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interrupt queues, at teardown:\nvc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()\nruns from the drm-managed release, after vc4_v3d_unbind() has already\nuninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed\nby then reads V3D registers through the NULL vc4->v3d pointer, and the\nlate callbacks run on the vc4_dev embedding them after it has been\nfreed.\n\nDrain them in vc4_v3d_unbind(", "references": ["https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240", "https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731", "https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99094", "noindex": false, "published": "2026-10-26T14:52:02.053Z", "modified": "2026-10-26T14:52:02.053Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99094", "title": "Bluetooth: btintel_pcie: fix TX descriptor bounds check", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix TX descriptor bounds check\n\nbtintel_pcie_prepare_tx() uses tfd_index to access the TFD and data\nbuffer arrays before the index is advanced modulo txq->count. An index\nequal to txq->count is one past the end of both arrays, so reject it in\nthe bounds check.", "references": ["https://git.kernel.org/stable/c/08704ec6d4bf69725e7815b09a9b5c7af83e255b", "https://git.kernel.org/stable/c/39ab048cce70d50af48015f5f294c4cf80d6ba89", "https://git.kernel.org/stable/c/2669567615215d52fb306053cbcc1f53dc386158"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99093", "noindex": false, "published": "2026-10-26T14:52:01.450Z", "modified": "2026-10-26T14:52:01.450Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99093", "title": "mm: don't schedule deferred kernel page table freeing while booting", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: don't schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n  ftrace=function ftrace_filter=pud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n  [   23.531178] Starting tracer 'function'\n  [   23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n  [   23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n  [   23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec837", "references": ["https://git.kernel.org/stable/c/7a25ca170c12a9328f6fcf4410713beb516b01c0", "https://git.kernel.org/stable/c/df6c704a08bc0925d5db047b0a6221f962bda4d9", "https://git.kernel.org/stable/c/2fb552b0bee70c24c092720028ab4620f5eb2646"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99092", "noindex": false, "published": "2026-10-26T14:52:00.860Z", "modified": "2026-10-26T14:52:00.860Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99092", "title": "riscv: patch: fix handling of bpf-jit execmem addresses", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: patch: fix handling of bpf-jit execmem addresses\n\nCommit 8718e5a3090b (\"riscv: patch: skip fixmap mapping when kernel text\nis already writable\") gated the core_kernel_text() branch of patch_map()\non CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch\nunchanged. That branch has a separate problem.\n\nThat branch only creates a temporary writable fixmap alias when\nCONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is\ndirectly writable and returns the address unchanged. That assumption no\nlonger holds: bpf_prog_pack_alloc calls set_memory_ro", "references": ["https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d", "https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858", "https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99091", "noindex": false, "published": "2026-10-26T14:52:00.262Z", "modified": "2026-10-26T14:52:00.262Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99091", "title": "Bluetooth: MGMT: Fix status of pending commands flushed on power off", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix status of pending commands flushed on power off\n\ncmd_complete_rsp() receives a struct cmd_lookup and, for a pending\ncommand that has no cmd_complete callback, falls through to\ncmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so\nthe status sent comes from the first byte of match->sk's\nrepresentation, not from match->mgmt_status.\n\ncommit f53e1c9c726d (\"Bluetooth: MGMT: Fix possible crash on\nmgmt_index_removed\") changed the callers' data from &status to &match\nand updated the cmd_complete branch to match->mgmt_status, but left\nthe fall-thro", "references": ["https://git.kernel.org/stable/c/44ce36c5789ac84e65de1e98c32db9a5ac04ed47", "https://git.kernel.org/stable/c/7ed7e038b520cf0dfa12d61c2caddb95e2f6922d", "https://git.kernel.org/stable/c/ec227cddd13cd7ac9077d263a73473ac370a055d"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99090", "noindex": false, "published": "2026-10-26T14:51:59.654Z", "modified": "2026-10-27T15:53:00.938Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99090", "title": "drm/amdgpu: serialize vblank counter reads against GPU reset", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: serialize vblank counter reads against GPU reset\n\nThe vblank counter callback reads display registers and scanout\nposition without holding reset_domain->sem. During GPU recovery,\ndisplay commit work can call the callback while reset owns the\nsemaphore for writing. The hardware access then triggers the\nlockdep_assert_held() in amdgpu_device_skip_hw_access() and sets\nTAINT_WARN when lockdep is enabled.\n\nTry to acquire the reset semaphore for reading before accessing the\nhardware, and hold it across the counter and scanout-position reads.\nIf reset is already in prog", "references": ["https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5", "https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e", "https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99089", "noindex": false, "published": "2026-10-26T14:51:59.055Z", "modified": "2026-10-26T14:51:59.055Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99089", "title": "ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n\nThe probe function puts the device into the runtime PM active state with\nonly the \"iis\" bus clock enabled, but it also sets priv->op_clk to the\nparent of the RCLK_SRC mux without enabling it. The runtime PM suspend\ncallback disables both clocks, so the first runtime suspend after probe\ndisables op_clk once more than it was enabled.\n\nOn Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate,\nso this triggers the following warning during boot:\n\n WARNING: drivers/clk/clk.c:1270 at clk_core_disable", "references": ["https://git.kernel.org/stable/c/2c64c30d493d82d5edc95811cede0083e1195822", "https://git.kernel.org/stable/c/5dac6bf09b5a4fff2433629801309c3884c3e94a", "https://git.kernel.org/stable/c/64bb35079dcbc67901da1fe8c52c234cbcd17df3"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99088", "noindex": false, "published": "2026-10-26T14:51:58.460Z", "modified": "2026-10-26T14:51:58.460Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99088", "title": "net: openvswitch: validate transport header presence in set_ipv6_addr", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key->ip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto.  Because skb->transport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although\nit is completely harmless.", "references": ["https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599", "https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da", "https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-98943", "noindex": false, "published": "2026-10-26T00:00:00Z", "modified": "2026-10-28T08:25:25.397603833Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98943", "title": "UBUNTU-CVE-2026-98943", "description": "In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock.", "references": ["https://ubuntu.com/security/CVE-2026-98943", "https://www.cve.org/CVERecord?id=CVE-2026-98943", "https://git.kernel.org/stable/c/6bce4b221dc0e144180c333123dbb82d1dc3a500"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99087", "noindex": false, "published": "2026-10-23T12:45:05.714Z", "modified": "2026-10-23T12:45:05.714Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99087", "title": "dm-integrity: fix NULL pointer dereference when the 'R' flag is used", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.", "references": ["https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f", "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956", "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99086", "noindex": false, "published": "2026-10-23T12:45:04.496Z", "modified": "2026-10-23T12:45:04.496Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99086", "title": "dm-integrity: validate the superblock on resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic->sb->log2_sectors_per_block, while ic->journa", "references": ["https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada", "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e", "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99085", "noindex": false, "published": "2026-10-23T12:45:03.465Z", "modified": "2026-10-23T12:45:03.465Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99085", "title": "sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can't pull the task back. The dying CPU goes idle with\nthe task", "references": ["https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c", "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064", "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-26T06:56:58.783Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99082", "noindex": false, "published": "2026-10-23T12:45:00.798Z", "modified": "2026-10-24T14:10:23.875Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99082", "title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, sup", "references": ["https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99081", "noindex": false, "published": "2026-10-23T12:23:28.347Z", "modified": "2026-10-24T14:10:22.790Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99081", "title": "bnxt_en: fix DMA mapping length for padded small packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a D", "references": ["https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268", "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-26T06:56:57.576Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": [], "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}]}], "total": 6220, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-oracle", "path": "vulns/ubuntu-26.04-lts/linux-oracle", "ecosystem": "Ubuntu:26.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 896, "kev": 0}, "lastmod": "2026-10-28T08:25:25.397603833Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}