{"kind": "product", "path": "vulns/ubuntu-26.10/linux-riscv", "name": "linux-riscv", "product": "linux-riscv", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-99086", "noindex": false, "published": "2026-10-23T12:45:04.496Z", "modified": "2026-10-23T12:45:04.496Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99086", "title": "dm-integrity: validate the superblock on resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic->sb->log2_sectors_per_block, while ic->journa", "references": ["https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada", "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e", "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99085", "noindex": false, "published": "2026-10-23T12:45:03.465Z", "modified": "2026-10-23T12:45:03.465Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99085", "title": "sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can't pull the task back. The dying CPU goes idle with\nthe task", "references": ["https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c", "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064", "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99084", "noindex": false, "published": "2026-10-23T12:45:02.631Z", "modified": "2026-10-23T12:45:02.631Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99084", "title": "readdir: take no inode lock on an immutable directory", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreaddir: take no inode lock on an immutable directory\n\niterate_dir() takes the directory's i_rwsem shared and holds it across\n->iterate_shared(). For a directory that never has an entry and is\nnever removed the lock keeps nothing still, it only orders every reader\nand every writer of that inode behind each other.\n\nFor the directory of a nullfs instance that matters. The instance of\nthe initial mount namespace is the root of every empty mount namespace\nand the private instance is the root of every kernel thread, so one\ninode is shared across users who have nothing else in com", "references": ["https://git.kernel.org/stable/c/6d30b399ae28e5166d62484f81ccaefde6fe7996", "https://git.kernel.org/stable/c/e08f57a7dcb83818c058e415988c23beb6c5a47f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99084"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99082", "noindex": false, "published": "2026-10-23T12:45:00.798Z", "modified": "2026-10-24T14:10:23.875Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99082", "title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, sup", "references": ["https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99081", "noindex": false, "published": "2026-10-23T12:23:28.347Z", "modified": "2026-10-24T14:10:22.790Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99081", "title": "bnxt_en: fix DMA mapping length for padded small packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a D", "references": ["https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268", "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99074", "noindex": false, "published": "2026-10-23T12:23:17.866Z", "modified": "2026-10-23T12:23:17.866Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0015, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99074", "title": "ipv4: stop PMTU walk when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh->nh_grp.  RCU protects each group's lifetime but\ndoes not make the loads observe the same group.  If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\nopera", "references": ["https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a", "https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87", "https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99073", "noindex": false, "published": "2026-10-23T12:23:16.935Z", "modified": "2026-10-23T12:23:16.935Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99073", "title": "ipv4: stop exception dump when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.", "references": ["https://git.kernel.org/stable/c/f91e472821e32f58b03eb631e20a67157e2b928b", "https://git.kernel.org/stable/c/21cba134c30c17ae55f468b5809336437df5d7e6", "https://git.kernel.org/stable/c/b9a30bb7b831e8c5a47fadbdf1760918aaf009cc"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99072", "noindex": false, "published": "2026-10-23T12:23:15.735Z", "modified": "2026-10-23T12:23:15.735Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99072", "title": "ipv4: stop route notification sizing when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, ", "references": ["https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78", "https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54", "https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99071", "noindex": false, "published": "2026-10-23T12:23:14.297Z", "modified": "2026-10-23T12:23:14.297Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00201, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99071", "title": "ipv4: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU.  With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots.  fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning.  The", "references": ["https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56", "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0", "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99070", "noindex": false, "published": "2026-10-23T12:23:13.342Z", "modified": "2026-10-23T12:23:13.342Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99070", "title": "ipv6: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners.", "references": ["https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d", "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae", "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99069", "noindex": false, "published": "2026-10-23T12:23:12.396Z", "modified": "2026-10-23T12:23:12.396Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99069", "title": "Input: ati_remote2 - fix type confusion in device attribute handlers", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer ", "references": ["https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89", "https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b", "https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99068", "noindex": false, "published": "2026-10-23T12:23:11.461Z", "modified": "2026-10-23T12:23:11.461Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99068", "title": "ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list.", "references": ["https://git.kernel.org/stable/c/f7dc71c1ce885f5d9f128037ebc75d9c0356e060", "https://git.kernel.org/stable/c/0919d8dd19f92e12829055c75fced9a454d644bf", "https://git.kernel.org/stable/c/593d46fc6af9a0178a46e77d6d24b20d2314165f"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99067", "noindex": false, "published": "2026-10-23T12:23:10.430Z", "modified": "2026-10-23T12:23:10.430Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99067", "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "references": ["https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6", "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99066", "noindex": false, "published": "2026-10-23T12:23:09.516Z", "modified": "2026-10-23T12:23:09.516Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99066", "title": "can: dev: init_can_skb(): restore skb header initialization", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: init_can_skb(): restore skb header initialization\n\nCommit 9f10374bb024 (\"can: remove private CAN skb headroom infrastructure\")\nremoved the skb_reset_mac_header()/skb_reset_network_header()/\nskb_reset_transport_header() calls from init_can_skb(). As a result, RX\nskbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.\nWhen such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length\ncalculation overflows and triggers skb_under_panic -> kernel BUG -> full\nmachine panic.\n\nThe same issue was originally reported in 2014 on linux-can and fixed by\nco", "references": ["https://git.kernel.org/stable/c/8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632", "https://git.kernel.org/stable/c/0a04c0cb8606ff88399489d03ef255afe90d0d5f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99066"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99065", "noindex": false, "published": "2026-10-23T12:23:08.458Z", "modified": "2026-10-23T12:23:08.458Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00166, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99065", "title": "cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()\n\nWith commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug processing\nsynchronous\"), the cpuset hotplug operation becomes synchronous. That\ncommit also removes the code that handles race between cpuset_hotplug_work\nand cpu hotplug notifier with the assumption that race is now gone.\nLater commit 7a0aabd9ce69 (\"cgroup/cpuset: Always use cpu_active_mask\")\nupdates the cpuset code to always use cpu_active_mask instead of\ncpu_online_mask in some places including guarantee_online_cpus() which\nis renamed to guaran", "references": ["https://git.kernel.org/stable/c/8d88d3221204fbb1b6dc2c0f2f2181fe49126639", "https://git.kernel.org/stable/c/a21c255159bfe0034740292e10d2e258feeeb10d", "https://git.kernel.org/stable/c/23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99064", "noindex": false, "published": "2026-10-23T12:23:05.854Z", "modified": "2026-10-24T14:10:17.979Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00516, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99064", "title": "cipso: adjust cached option offsets when removing CIPSO", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30.  Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30.  Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delop", "references": ["https://git.kernel.org/stable/c/b965977126a90e01825814c859ba4788691eddd3", "https://git.kernel.org/stable/c/2200fe1d6148b78e1b8f00f4b2bd47760015077f", "https://git.kernel.org/stable/c/6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99063", "noindex": false, "published": "2026-10-23T12:23:04.655Z", "modified": "2026-10-23T12:23:04.655Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99063", "title": "dm ioctl: don't let data_start run past the buffer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n  Read o", "references": ["https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920", "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61", "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99062", "noindex": false, "published": "2026-10-23T12:23:03.360Z", "modified": "2026-10-23T12:23:03.360Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99062", "title": "vsock/virtio: account only unread bytes in read_skb()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: account only unread bytes in read_skb()\n\nAfter a partial stream receive, rx_bytes tracks the unread suffix while\nbuf_used and peer credit still cover the whole packet.\nvirtio_transport_read_skb() dequeues that packet but passes pkt_len for\nboth counters, underflowing rx_bytes.\n\nOn a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read\nfrom a 100-byte packet made SIOCINQ report -40, an empty recv return\nELOOP, and poll report the empty socket readable.  After verdict detach,\nreceiving 40 bytes wrapped the counter to zero and hid those queued bytes\nu", "references": ["https://git.kernel.org/stable/c/e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b", "https://git.kernel.org/stable/c/38bad3930b1185dd6c98db3dd342ddc123c6f3ef", "https://git.kernel.org/stable/c/dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99061", "noindex": false, "published": "2026-10-23T12:22:59.770Z", "modified": "2026-10-23T12:22:59.770Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99061", "title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the ", "references": ["https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163", "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f", "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-99060", "noindex": false, "published": "2026-10-23T12:22:49.164Z", "modified": "2026-10-23T12:22:49.164Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99060", "title": "wifi: mt76: mt7603: initialize global station WCID", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7603: initialize global station WCID\n\nmt7603 uses a driver-private global station WCID for frames that have\nneither a station nor a vif, including frames injected through a monitor\ninterface. Unlike the core global WCID initialized by\nmt76_register_device(), this WCID is published without ever being passed\nto mt76_wcid_init().\n\nSince commit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\"), mt76_tx() queues every such frame on the\nWCID's tx_pending or tx_offchannel queue and links its tx_list. The first\ninjected frame ther", "references": ["https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff", "https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6", "https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb"], "fixes": [], "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}]}], "total": 229, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 12, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-riscv", "path": "vulns/ubuntu-26.10/linux-riscv", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 141, "kev": 0}, "lastmod": "2026-10-24T14:10:23.875Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}