{"kind": "product", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "name": "linux-aws-7.0", "product": "linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS", "items": [{"id": "CVE-2026-99216", "noindex": false, "published": "2026-10-28T10:36:09.383Z", "modified": "2026-10-28T10:36:09.383Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99216", "title": "Drivers: hv: Don't reset VMBus connection state on error/exit paths", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started ch", "references": ["https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5", "https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195", "https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99215", "noindex": false, "published": "2026-10-28T10:36:08.618Z", "modified": "2026-10-28T10:36:08.618Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99215", "title": "power: supply: core: prevent unregistering a power supply while a callback runs", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after ", "references": ["https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090", "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6", "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99214", "noindex": false, "published": "2026-10-28T10:36:07.867Z", "modified": "2026-10-28T10:36:07.867Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99214", "title": "drm/vc4: hdmi: Move packet RAM enable to PM runtime", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[  201.570266] ------------[ cut here ]------------\n[  201.570293] Packet RAM has", "references": ["https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27", "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2", "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99213", "noindex": false, "published": "2026-10-28T10:36:06.441Z", "modified": "2026-10-28T10:36:06.441Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99213", "title": "vsock: treat TCP_CLOSING as once-established", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_t", "references": ["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7", "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d", "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99212", "noindex": false, "published": "2026-10-28T10:36:05.612Z", "modified": "2026-10-28T10:36:05.612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99212", "title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect", "references": ["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99211", "noindex": false, "published": "2026-10-28T10:36:04.864Z", "modified": "2026-10-28T10:36:04.864Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99211", "title": "netlink: reset skb headers before unicast and multicast filtering", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb's network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket's\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in ", "references": ["https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d", "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47", "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99210", "noindex": false, "published": "2026-10-28T10:36:04.110Z", "modified": "2026-10-28T10:36:04.110Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99210", "title": "accel/rocket: clear rdev on device init failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: clear rdev on device init failure\n\nrocket_probe() stores the return value from rocket_device_init() in the\nfile-scoped rdev pointer before checking whether it is an error pointer.\nIf rocket_device_init() fails, rdev is left as an ERR_PTR.\n\nThe rdev pointer is also used as the marker for whether the shared rocket\ndevice has already been initialized. A later core probe can therefore see\na non-NULL rdev, skip rocket_device_init(), and dereference the error\npointer when reading rdev->num_cores.\n\nSave the error code and clear rdev before returning from the\nrocket_de", "references": ["https://git.kernel.org/stable/c/79071b67182e1b352d51a3917729b8d424710b49", "https://git.kernel.org/stable/c/dd47a6c920083b069f00f0920e4566915a6aec46", "https://git.kernel.org/stable/c/4ac852419f0d317c7bd8db5b8acb3cc78be7fe33"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99209", "noindex": false, "published": "2026-10-28T10:36:03.274Z", "modified": "2026-10-28T10:36:03.274Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99209", "title": "drm/xe: skip eviction of a BO with no resource", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: skip eviction of a BO with no resource\n\nxe_evict_flags() switches on tbo->resource->mem_type to choose an\neviction placement. An xe BO can reach eviction with no ttm.resource,\ne.g. an imported dma-buf BO whose resource was freed during teardown\nwhile its attachment is still live: the exporter then invalidates it via\nxe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a\nNULL resource and faults.\n\nA BO with no resource has nothing placed or mapped, so there is nothing\nto evict. Return an empty placement (num_placement = 0), mirroring the\nhandling alr", "references": ["https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f", "https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8", "https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99208", "noindex": false, "published": "2026-10-28T10:36:01.473Z", "modified": "2026-10-28T10:36:01.473Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99208", "title": "drm/xe/oa: Zero OA buffer at allocation", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Zero OA buffer at allocation\n\nttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and\nmay contain data from previously freed pages. Since the OA buffer is\nmmap'able by userspace, this can expose stale kernel memory contents.\n\nStreams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA\nbuffer without calling xe_oa_init_oa_buffer(). Zero the buffer at\nallocation to prevent information disclosure through mmap.\n\nThe existing zeroing in xe_oa_init_oa_buffer() remains necessary for\nzero report-id/timestamp detection on enable/re-enable.\n\n(cherry ", "references": ["https://git.kernel.org/stable/c/21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9", "https://git.kernel.org/stable/c/cd3e2918c247db631d88cdd704596d9d27e5513e", "https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99206", "noindex": false, "published": "2026-10-28T10:35:59.851Z", "modified": "2026-10-28T10:35:59.851Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99206", "title": "scsi: target: iscsi: Fix race in discovery auth updates", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.", "references": ["https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999", "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099", "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99205", "noindex": false, "published": "2026-10-28T10:35:59.093Z", "modified": "2026-10-28T10:35:59.093Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99205", "title": "sched/core: Call wakeup_preempt() for queued tasks during class change", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Call wakeup_preempt() for queued tasks during class change\n\nPaul reported recent RCU changes exposed a lost resched where CPU idles\nwith a rcutorture thread waiting while being completely runnable.\n\nDumping the rq state at the time of idling with runnable tasks showed\nthe following:\n\n  rq->next_class = &fair_sched_class\n  rq->nr_running = 1\n  rq->cfs.h_nr_queued = 0\n  rq->rt.rt_nr_running = 1\n\nAlthough the waiting task was an RT task, \"rq->next_class\" did not point\nto rt_sched_class and was stuck at the lower priority fair_sched_class.\n\nInspecting sched_change_en", "references": ["https://git.kernel.org/stable/c/ae89744c5ebf299bf55ac7581768fbd9f119a903", "https://git.kernel.org/stable/c/118a2cf4ced60777a2408001e2b4838fed1cea55", "https://nvd.nist.gov/vuln/detail/CVE-2026-99205"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99204", "noindex": false, "published": "2026-10-28T10:35:58.336Z", "modified": "2026-10-28T10:35:58.336Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99204", "title": "ocfs2/dlm: Protect the recovery list during debugfs reads", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock,", "references": ["https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537", "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284", "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99203", "noindex": false, "published": "2026-10-28T10:35:57.589Z", "modified": "2026-10-28T10:35:57.589Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99203", "title": "pipe: preserve existing fasync readers on writer setup failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), s", "references": ["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa", "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521", "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99202", "noindex": false, "published": "2026-10-28T10:35:56.827Z", "modified": "2026-10-28T10:35:56.827Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99202", "title": "scsi: libsas: Fix SMP IO deadlock during HA resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()\n-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset f", "references": ["https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c", "https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85", "https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99201", "noindex": false, "published": "2026-10-28T10:35:56.069Z", "modified": "2026-10-28T10:35:56.069Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99201", "title": "netlink: avoid hashing the network namespace pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey ", "references": ["https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99192", "noindex": false, "published": "2026-10-28T10:35:48.686Z", "modified": "2026-10-28T10:35:48.686Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99192", "title": "net: bcmgenet: unshare the skb before writing the control block", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the dri", "references": ["https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac", "https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672", "https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99191", "noindex": false, "published": "2026-10-28T10:35:47.854Z", "modified": "2026-10-28T10:35:47.854Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99191", "title": "calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr->payload_len);\n\tip6_hdr->payload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb->len.  For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer ", "references": ["https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513", "https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656", "https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99190", "noindex": false, "published": "2026-10-28T10:35:47.107Z", "modified": "2026-10-28T10:35:47.107Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00177, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99190", "title": "gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths\n\nA drive-by review by Sashiko reports that, after a failed call to\ngpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,\nbypassing the freeing of possibly alloced bitmaps, potentially leaking\nmemory. It is an unlikely error path, but is possible.\n\nDefer the return code check until after the bitmap_free() block.", "references": ["https://git.kernel.org/stable/c/78189c0e35abbcdab3b8ab0b764d578c02900734", "https://git.kernel.org/stable/c/890c3bf08e0fc09eff788a6cfeded7d21b4d3e9d", "https://git.kernel.org/stable/c/c28846ca1ac6134881114d272314623c8433e372"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99189", "noindex": false, "published": "2026-10-28T10:35:46.366Z", "modified": "2026-10-28T10:35:46.366Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99189", "title": "gpio: mxc: fix race between chained IRQ handler install and probe completion", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n   port->domain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n   been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_", "references": ["https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68", "https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82", "https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-99188", "noindex": false, "published": "2026-10-28T10:35:45.591Z", "modified": "2026-10-28T10:35:45.591Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99188", "title": "net: stmmac: dwmac1000: clear the RGMII status interrupt", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: dwmac1000: clear the RGMII status interrupt\n\nSince commit 2e2c878a3141 (\"net: stmmac: remove SGMII/RGMII/SMII\ninterrupt handling\") nothing on the RGMII path reads GMAC_RGSMIIIS, so\nRGSMIIIS stays pending behind GMAC_INT_MASK from the first link change\non. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets\nGMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,\nand the pending status storms the line:\n\n  dwmac_dma_interrupt: unexpected status 04000000\n\nA register dump at the first message on ODROID-HC4 showed it:\n\n  core int_status 0", "references": ["https://git.kernel.org/stable/c/affc6d572935282ef9ab1e0b790cbc31e5ad8bca", "https://git.kernel.org/stable/c/aa07285705f8d5bac464eb1c5b7412f8e88b91e1", "https://nvd.nist.gov/vuln/detail/CVE-2026-99188"], "fixes": [], "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}]}], "total": 5212, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-aws-7.0", "path": "vulns/ubuntu-24.04-lts/linux-aws-7.0", "ecosystem": "Ubuntu:24.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 987, "kev": 0}, "lastmod": "2026-10-28T10:36:09.383Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}