{"kind": "product", "path": "vulns/ubuntu-pro-14.04-lts/linux", "name": "linux", "product": "linux", "ecosystem": "Ubuntu:Pro:14.04:LTS", "items": [{"id": "CVE-2026-98943", "noindex": false, "published": "2026-10-26T00:00:00Z", "modified": "2026-10-28T01:09:36.628858193Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98943", "title": "UBUNTU-CVE-2026-98943", "description": "In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock.", "references": ["https://ubuntu.com/security/CVE-2026-98943", "https://www.cve.org/CVERecord?id=CVE-2026-98943", "https://git.kernel.org/stable/c/6bce4b221dc0e144180c333123dbb82d1dc3a500"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-26T06:56:58.783Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-26T06:56:57.576Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99077", "noindex": false, "published": "2026-10-23T12:23:22.773Z", "modified": "2026-10-26T15:13:01.358Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00374, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99077", "title": "ipv4: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless ", "references": ["https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592", "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a", "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99067", "noindex": false, "published": "2026-10-23T12:23:10.430Z", "modified": "2026-10-23T12:23:10.430Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99067", "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "references": ["https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6", "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99063", "noindex": false, "published": "2026-10-23T12:23:04.655Z", "modified": "2026-10-23T12:23:04.655Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99063", "title": "dm ioctl: don't let data_start run past the buffer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n  Read o", "references": ["https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920", "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61", "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99058", "noindex": false, "published": "2026-10-23T12:22:45.920Z", "modified": "2026-10-23T12:22:45.920Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99058", "title": "workqueue: Fix NULL current_pwq deref in chained work check", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker->current_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker->current_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarni", "references": ["https://git.kernel.org/stable/c/3dc61af2998cfc7312d6e59bbdcd5eed074483f2", "https://git.kernel.org/stable/c/729d576df89c7e4341e58c452f8890620a610ac2", "https://git.kernel.org/stable/c/b12a25fb2b9d5dac80e419d695450cc17a51fdfd"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99054", "noindex": false, "published": "2026-10-23T12:22:36.886Z", "modified": "2026-10-24T14:10:14.659Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99054", "title": "tipc: destroy topsrv workqueues before closing connections", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed w", "references": ["https://git.kernel.org/stable/c/7f796bb3b440d7f1b14c0e3b520462eb34f553af", "https://git.kernel.org/stable/c/da9c16568bc79140a54c1f5fcf07a0305df47b37", "https://git.kernel.org/stable/c/0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99052", "noindex": false, "published": "2026-10-23T12:22:34.168Z", "modified": "2026-10-23T12:22:34.168Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99052", "title": "selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts\n\nWhen an NFSv4 filesystem exported with security_label is mounted a\nsecond time, sget_fc() returns the existing superblock and\nnfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the\nsuperblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an\nearly exit without setting SECURITY_LSM_NATIVE_LABELS in\n*set_kern_flags. nfs_get_root() then sees kflags without\nSECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on\nthe shared nfs_server, silently disabling per-file labeli", "references": ["https://git.kernel.org/stable/c/a545def625860d4ccedc14fe45e884a62a041cef", "https://git.kernel.org/stable/c/a6da93c625b3557dd23ff6db45d2d1bafeae1565", "https://git.kernel.org/stable/c/5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99039", "noindex": false, "published": "2026-10-23T12:21:57.421Z", "modified": "2026-10-23T12:21:57.421Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99039", "title": "memstick: core: wait for request completion before freeing card", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: core: wait for request completion before freeing card\n\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\n\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\n\nHowever, the host co", "references": ["https://git.kernel.org/stable/c/c3ab92542475d59ae685cbb294e70ca4d0ba38e9", "https://git.kernel.org/stable/c/810580cf60edc75c9891c2de3225e4cda78e4d9f", "https://git.kernel.org/stable/c/f2795c50144d528dabc2cf2fd53c0f0c63a823a1"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99036", "noindex": false, "published": "2026-10-23T12:21:49.410Z", "modified": "2026-10-26T06:56:56.323Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99036", "title": "dm: fix reading free memory in do_resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix reading free memory in do_resume\n\nWhen do_resume calls dm_table_get_mode(new_map), the call is done without\nholding any locks (it only holds a reference to the md). It may be\npossible that another concurrent ioctl on the same device will swap table\nafter dm_swap_table and before dm_table_get_mode. In this case,\ndm_table_get_mode(new_map) reads freed memory.\n\nThis race condition was triggered by syzbot.\n\nThis commit fixes the race by reading mode of the new table before\ndm_swap_table. Note that new_map is also passed to dm_ima_need_measure,\nbut this function doesn't a", "references": ["https://git.kernel.org/stable/c/281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c", "https://git.kernel.org/stable/c/2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82", "https://git.kernel.org/stable/c/e3bf232c913b7e0103d323f15e6342d37cb1b357"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99027", "noindex": false, "published": "2026-10-23T12:21:14.896Z", "modified": "2026-10-23T12:21:14.896Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99027", "title": "net: team: stop reusing skb after queue override", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: stop reusing skb after queue override\n\nA nonzero dev_queue_xmit() result does not return ownership of the skb.\nWhen an override port's qdisc drops it, the queue override helper used to\ntry another port or the mode transmit op with the freed skb.\n\nReturn the handoff decision separately from transmit success. Select only\nthe first override port under RCU and stop after handing it the skb,\nregardless of the lower transmit result. Keep the existing success and\ndrop accounting.\n\n  BUG: KASAN: slab-use-after-free in sk_skb_reason_drop\n  Write of size 4 by task poc/5040\n", "references": ["https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a", "https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523", "https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99026", "noindex": false, "published": "2026-10-23T12:21:13.509Z", "modified": "2026-10-23T12:21:13.509Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99026", "title": "net: team: free skb when broadcast has no txable port", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: free skb when broadcast has no txable port\n\nbc_transmit() sends the original skb through the last txable port.\nWhen no port is txable, it returns false without consuming the skb, but\nteam_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the\nskb and its socket write-memory charge.\n\nA TX-enabled, link-down port keeps the broadcast transmit op installed.\nCarrier can stay up through a second link-up, TX-disabled port or be\nforced on by userspace. Free the original skb on the no-port path while\nleaving the existing drop accounting intact.\n\nDiscovered by S", "references": ["https://git.kernel.org/stable/c/961563117626f4681623077ec0cfd86f86da0d49", "https://git.kernel.org/stable/c/f34b1bcac4581a5bd3daf9eff90f175e736b54aa", "https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99019", "noindex": false, "published": "2026-10-23T12:20:55.832Z", "modified": "2026-10-23T12:20:55.832Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99019", "title": "scsi: ch: Do not keep references to data transfer element devices", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ch: Do not keep references to data transfer element devices\n\nch_readconfig() looks up the scsi_device of every data transfer element\nwhose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in\nch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops\nit: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere\nelse - it only supplies the vendor, model and revision printed in the same\nloop.\n\nOnce such a drive is removed, its scsi_device can never be released. It\nstays on the host's device list at its address, so a new device ther", "references": ["https://git.kernel.org/stable/c/ec6ecab1b7577ae555ee6b81480814d123dd9ec0", "https://git.kernel.org/stable/c/cef2cedb6f7a394b278775b3d6ffb9b20ecd61db", "https://git.kernel.org/stable/c/a34a230ccea1b8b667ae59dca11295a2c8f81738"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99010", "noindex": false, "published": "2026-10-23T12:20:35.485Z", "modified": "2026-10-23T12:20:35.485Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99010", "title": "Bluetooth: RFCOMM: free the skb when the DLC has no owner", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: free the skb when the DLC has no owner\n\nrfcomm_recv_data() hands the skb to d->data_ready() and returns 0\nwithout freeing it, so the callback owns the skb from that point on.\nThe tty implementation frees it when the DLC has been detached from its\ndevice:\n\n  static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,\n                                    struct sk_buff *skb)\n  {\n          struct rfcomm_dev *dev = dlc->owner;\n\n          if (!dev) {\n                  kfree_skb(skb);\n                  return;\n          }\n\nThe socket implementation returns without ", "references": ["https://git.kernel.org/stable/c/a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9", "https://git.kernel.org/stable/c/c3f76b025cbbb0ab47310dbe7de18092d89f2a99", "https://git.kernel.org/stable/c/4f46de658ce61968aef5ea7ae809d1c180330544"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99008", "noindex": false, "published": "2026-10-23T12:20:33.355Z", "modified": "2026-10-23T12:20:33.355Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99008", "title": "Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n\nsyzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an\nRFCOMM tty is closed.\n\nrfcomm_dev_add() puts the new device on rfcomm_dev_list first and only\nthen registers the tty device and saves it in dev->tty_dev. If that\nregistration fails, dev->tty_dev is never set at all. The device can be\nlooked up in the meantime, so an open() of /dev/rfcommN gets through\nrfcomm_tty_install() and attaches to it. When that tty is closed again,\nrfcomm_dev_shutdown() uses dev->tty_dev without checking it:\n\n ", "references": ["https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df", "https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433", "https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99002", "noindex": false, "published": "2026-10-23T12:20:22.763Z", "modified": "2026-10-24T14:09:57.241Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99002", "title": "drm/vmwgfx: validate pitch coming from userspace", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.", "references": ["https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d", "https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c", "https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-98978", "noindex": false, "published": "2026-10-23T12:19:51.428Z", "modified": "2026-10-24T14:09:47.444Z", "cvss": 8.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.0017, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98978", "title": "namespace: never expire a locked mount", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn't.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -> x/hid", "references": ["https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c", "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644", "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-98977", "noindex": false, "published": "2026-10-23T12:19:50.475Z", "modified": "2026-10-23T12:19:50.475Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98977", "title": "namespace: handle mount locking for automounts correctly", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: handle mount locking for automounts correctly\n\nIf mounts are propagated across user namespaces, attach_recursive_mnt()\nlocks every copy of the source mount to protect overmounts from\nvanishing and revealing the underlying files or directories.\n\nThe user namespace is taken from the caller's mount namespaces since\nthis is where the mounts end up. Except, that's not always true.\nAutomounts may legitimately get popped in by tasks located in a\ndifferent mount and user namespace during path lookup.\n\nThen check doesn't make sense at that point. The copy in the namespace\n", "references": ["https://git.kernel.org/stable/c/5e8f3ac8fa3d411b422ad32b9168c46a4824cc79", "https://git.kernel.org/stable/c/b3ccde78f1608836e62320428abc0e8aa9cf2329", "https://git.kernel.org/stable/c/e01c79761c7b3373e80094c5eadb21cb864fa8bc"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-98969", "noindex": false, "published": "2026-10-23T12:19:42.012Z", "modified": "2026-10-23T12:19:42.012Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98969", "title": "net/sched: em_text: reject unterminated algo before autoload", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: em_text: reject unterminated algo before autoload\n\nThis is a follow-up to commit 9c572a83037a (\"net/sched: fix potential\nstack infoleak in em_text_dump()\"), which zero-initialised the dump-side\nstruct. Sashiko pointed at a pre-existing bug that exposed the change-side\ninput-validation gap open.\n\nem_text_change() casts the raw netlink attribute payload to struct\ntcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL\nterminator, to textsearch_prepare().  On the TS_AUTOLOAD retry\ntextsearch_prepare() calls request_module(\"ts_%s\", algo); vsnprintf()\nw", "references": ["https://git.kernel.org/stable/c/00bcc303000bac524d62eed054d77372b38ace0f", "https://git.kernel.org/stable/c/22182f91c6703af6e9832cffe6d22b381031cb5a", "https://git.kernel.org/stable/c/85e5512369d4fe6e5f2c43712d9f9e01d4ae8437"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}], "total": 4642, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 220, "kev": 0}, "lastmod": "2026-10-28T01:09:36.628858193Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}