{"kind": "product", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "name": "linux-fips", "product": "linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS", "items": [{"id": "CVE-2026-99215", "noindex": false, "published": "2026-10-28T10:36:08.618Z", "modified": "2026-10-28T10:36:08.618Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99215", "title": "power: supply: core: prevent unregistering a power supply while a callback runs", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after ", "references": ["https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090", "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6", "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99213", "noindex": false, "published": "2026-10-28T10:36:06.441Z", "modified": "2026-10-28T10:36:06.441Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99213", "title": "vsock: treat TCP_CLOSING as once-established", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_t", "references": ["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7", "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d", "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99212", "noindex": false, "published": "2026-10-28T10:36:05.612Z", "modified": "2026-10-28T10:36:05.612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99212", "title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect", "references": ["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99211", "noindex": false, "published": "2026-10-28T10:36:04.864Z", "modified": "2026-10-28T10:36:04.864Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99211", "title": "netlink: reset skb headers before unicast and multicast filtering", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb's network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket's\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in ", "references": ["https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d", "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47", "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99206", "noindex": false, "published": "2026-10-28T10:35:59.851Z", "modified": "2026-10-28T10:35:59.851Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99206", "title": "scsi: target: iscsi: Fix race in discovery auth updates", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.", "references": ["https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999", "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099", "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99204", "noindex": false, "published": "2026-10-28T10:35:58.336Z", "modified": "2026-10-28T10:35:58.336Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99204", "title": "ocfs2/dlm: Protect the recovery list during debugfs reads", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock,", "references": ["https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537", "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284", "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99203", "noindex": false, "published": "2026-10-28T10:35:57.589Z", "modified": "2026-10-28T10:35:57.589Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99203", "title": "pipe: preserve existing fasync readers on writer setup failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), s", "references": ["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa", "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521", "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99201", "noindex": false, "published": "2026-10-28T10:35:56.069Z", "modified": "2026-10-28T10:35:56.069Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99201", "title": "netlink: avoid hashing the network namespace pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey ", "references": ["https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99181", "noindex": false, "published": "2026-10-28T10:35:34.443Z", "modified": "2026-10-28T10:35:34.443Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99181", "title": "autofs: ignore notification errors from a replaced pipe", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: ignore notification errors from a replaced pipe\n\nautofs_notify_daemon() takes a reference to the current notification\npipe under wq_mutex, then drops the mutex before writing the request. The\nwrite can block while the daemon enters catatonic mode and installs a\nreplacement pipe.\n\nIf the old pipe's reader is then closed, the delayed write returns -EPIPE\nand the generic error path enters catatonic mode again. That transition\nacts on the current superblock state, closes the replacement pipe, and\nreleases the new daemon generation's wait queues.\n\nOnly enter catatonic mod", "references": ["https://git.kernel.org/stable/c/1a177064f501ed4b67873a43aae5d5bdb18b3704", "https://git.kernel.org/stable/c/fb296391f685d82dbb93621a970fb234cea45280", "https://git.kernel.org/stable/c/65676cd4203c0e41a94caf54080a7f0a95434bda"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99178", "noindex": false, "published": "2026-10-28T10:35:31.961Z", "modified": "2026-10-28T10:35:31.961Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99178", "title": "x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context\n\nAn async #PF \"page not present\" event arrives through the #PF vector,\nand its reason sits in the per-CPU apf_reason.flags until\n__kvm_handle_async_pf() reads and clears it. If an NMI arrives after\nthe event is injected and before the #PF handler reads the flags, and\nthe NMI handler itself takes a #PF, that fault reads and clears the\nflags belonging to the #PF it interrupted. It then finds interrupts\ndisabled in the NMI context it interrupted, and panics:\n\n  Kernel panic - not syncing: Host injected async ", "references": ["https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921", "https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9", "https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99161", "noindex": false, "published": "2026-10-28T10:35:13.970Z", "modified": "2026-10-28T10:35:13.970Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99161", "title": "i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()\n\nIn wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any\nsubsequent operation fails or when the module is unloaded, the clock\nreference count is never decremented via clk_put(), leading to a\nresource leak.\n\nSwitch to devm_clk_get() so that the clock is automatically managed\nand released.", "references": ["https://git.kernel.org/stable/c/5d476bb76b7d72d8b7ed04a9c614900b097e3af7", "https://git.kernel.org/stable/c/1875de656370c89b99a150d220df876288ee0344", "https://git.kernel.org/stable/c/aaabefc79b0ff0018e8e3832169bbe359d0551fc"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99156", "noindex": false, "published": "2026-10-28T10:35:10.493Z", "modified": "2026-10-28T10:35:10.493Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99156", "title": "scsi: st: Fix use-after-free race between st_remove() and st_open()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() ", "references": ["https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822", "https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5", "https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99154", "noindex": false, "published": "2026-10-28T10:35:08.968Z", "modified": "2026-10-28T10:35:08.968Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99154", "title": "scsi: libiscsi: Reject a negative task index from parse_pdu_itt", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Reject a negative task index from parse_pdu_itt\n\nA transport that implements parse_pdu_itt hands libiscsi an index taken\nfrom the PDU, and both lookups bound it from above only:\n\n      if (i >= session->cmds_max)\n\ni and cmds_max are both int, so a negative index passes and\nsession->cmds[i] is read from before the array.\n\nbe2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,\n\n      *index = (int)itt;\n\nand beiscsi_complete_pdu() forwards an unsolicited NOP-In from the\nhardware async ring without replacing its ITT, so the value is the\ntarget's. It also", "references": ["https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e", "https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7", "https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99153", "noindex": false, "published": "2026-10-28T10:35:08.287Z", "modified": "2026-10-28T10:35:08.287Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99153", "title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NUL", "references": ["https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8", "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a", "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99152", "noindex": false, "published": "2026-10-28T10:35:07.622Z", "modified": "2026-10-28T10:35:07.622Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99152", "title": "scsi: libiscsi: Validate the task named by a management response", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n      case ISCSI_OP_LOGOUT_RSP:\n      case ISCSI_OP_LOGIN_RSP:\n      case ISCSI_OP_TEXT_RSP:\n      case ISCSI_OP_SCSI_TMFUNC_RSP:\n      case ISCSI_OP_NOOP_IN:\n              task = iscsi_itt_to_task(conn, hdr->itt);\n              if (!task)\n                      return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any", "references": ["https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936", "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860", "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99136", "noindex": false, "published": "2026-10-28T10:34:48.558Z", "modified": "2026-10-28T10:34:48.558Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99136", "title": "dm-crypt: fix a tiny race condition in crypt_dec_pending", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io->error before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io->error and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destru", "references": ["https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3", "https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8", "https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99133", "noindex": false, "published": "2026-10-28T10:34:46.398Z", "modified": "2026-10-28T10:34:46.398Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99133", "title": "net/iucv: fix the recvmsg window update", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix the recvmsg window update\n\niucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without\ntesting the transport, so on a classic z/VM socket iucv_send_ctrl() sizes\nthe skb through a NULL iucv->hs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2\nis zero and one recvmsg() on its own socket is enough for an unprivileged\nprocess to take a spurious disconnect.\n\nIt also calls iucv_send_ctrl() under spin_lock_bh(&message_q.lock), which\nallocates GFP_KERNEL inside a section the code treats as atomic. Sending\noutside that lock lets two recvmsg() reach afiucv_hs_sen", "references": ["https://git.kernel.org/stable/c/8f2efa742f4cfe7dd756154f8bc07350dbe3ec92", "https://git.kernel.org/stable/c/fe7393a627db2d093e8c0cae69d619b30fefae5f", "https://git.kernel.org/stable/c/fa5acd038ea657ad5033713d6916214cbd349151"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99128", "noindex": false, "published": "2026-10-28T10:34:42.229Z", "modified": "2026-10-28T10:34:42.229Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99128", "title": "sctp: validate chunk length in the inqueue parser", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association's SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built w", "references": ["https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659", "https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990", "https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99126", "noindex": false, "published": "2026-10-28T10:34:40.661Z", "modified": "2026-10-28T10:34:40.661Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99126", "title": "s390/ctcm: Prevent XID null dereference", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ctcm: Prevent XID null dereference\n\nThe mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40\nto signal XID validation error. If peer XID is NULL or r/w channel\npairing mismatch happens, grp->saved_xid2 is never initialized. An\nattempt to set the flag in such case leads to NULL dereference.\n\nFix this by using the always available priv->xid->xid2_flag2 instead of\ngrp->saved_xid2->xid2_flag2 for validation errors.", "references": ["https://git.kernel.org/stable/c/34fa3607b7604b3052b19cec8b0ad644818cdd2a", "https://git.kernel.org/stable/c/8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeab", "https://git.kernel.org/stable/c/b264d8422779d69febce914efc47a92a85cc382c"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}, {"id": "CVE-2026-99122", "noindex": false, "published": "2026-10-28T10:34:37.859Z", "modified": "2026-10-28T10:34:37.859Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99122", "title": "vsock/vmci: validate packet source for connected sockets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: validate packet source for connected sockets\n\nvmci_transport_recv_stream_cb() looks up sockets first by the full source\nand destination tuple, then by destination only in the bound table. The\nfallback can select a non-listening socket without checking whether the\npacket came from its stored peer.\n\nThis was reproduced with two VMCI contexts. A RST from the context not\nstored in a TCP_SYN_SENT socket reset that socket after it was selected by\nthe destination-only lookup.\n\nVMCI can process notification packets in bottom-half context when the\nsocket is not owned by u", "references": ["https://git.kernel.org/stable/c/c027f8b429dbb2157fc1b503df196e272d947c89", "https://git.kernel.org/stable/c/90c423b62ec9be08177f74b07a47937ca8d2035b", "https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"], "fixes": [], "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}]}], "total": 5401, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-fips", "path": "vulns/ubuntu-pro-fips-16.04-lts/linux-fips", "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 318, "kev": 0}, "lastmod": "2026-10-28T10:36:08.618Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}