{"kind": "product", "path": "vulns/ubuntu-pro-14.04-lts/linux", "name": "linux", "product": "linux", "ecosystem": "Ubuntu:Pro:14.04:LTS", "items": [{"id": "CVE-2026-99090", "noindex": false, "published": "2026-10-26T14:51:59.654Z", "modified": "2026-10-27T15:53:00.938Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99090", "title": "drm/amdgpu: serialize vblank counter reads against GPU reset", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: serialize vblank counter reads against GPU reset\n\nThe vblank counter callback reads display registers and scanout\nposition without holding reset_domain->sem. During GPU recovery,\ndisplay commit work can call the callback while reset owns the\nsemaphore for writing. The hardware access then triggers the\nlockdep_assert_held() in amdgpu_device_skip_hw_access() and sets\nTAINT_WARN when lockdep is enabled.\n\nTry to acquire the reset semaphore for reading before accessing the\nhardware, and hold it across the counter and scanout-position reads.\nIf reset is already in prog", "references": ["https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5", "https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e", "https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99088", "noindex": false, "published": "2026-10-26T14:51:58.460Z", "modified": "2026-10-26T14:51:58.460Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99088", "title": "net: openvswitch: validate transport header presence in set_ipv6_addr", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key->ip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto.  Because skb->transport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although\nit is completely harmless.", "references": ["https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599", "https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da", "https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-98943", "noindex": false, "published": "2026-10-26T00:00:00Z", "modified": "2026-10-28T08:25:25.397603833Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98943", "title": "UBUNTU-CVE-2026-98943", "description": "In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock.", "references": ["https://ubuntu.com/security/CVE-2026-98943", "https://www.cve.org/CVERecord?id=CVE-2026-98943", "https://git.kernel.org/stable/c/6bce4b221dc0e144180c333123dbb82d1dc3a500"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-26T06:56:58.783Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-26T06:56:57.576Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99077", "noindex": false, "published": "2026-10-23T12:23:22.773Z", "modified": "2026-10-26T15:13:01.358Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00374, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99077", "title": "ipv4: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless ", "references": ["https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592", "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a", "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99067", "noindex": false, "published": "2026-10-23T12:23:10.430Z", "modified": "2026-10-23T12:23:10.430Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99067", "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "references": ["https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6", "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99063", "noindex": false, "published": "2026-10-23T12:23:04.655Z", "modified": "2026-10-23T12:23:04.655Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99063", "title": "dm ioctl: don't let data_start run past the buffer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n  Read o", "references": ["https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920", "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61", "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99058", "noindex": false, "published": "2026-10-23T12:22:45.920Z", "modified": "2026-10-23T12:22:45.920Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99058", "title": "workqueue: Fix NULL current_pwq deref in chained work check", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker->current_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker->current_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarni", "references": ["https://git.kernel.org/stable/c/3dc61af2998cfc7312d6e59bbdcd5eed074483f2", "https://git.kernel.org/stable/c/729d576df89c7e4341e58c452f8890620a610ac2", "https://git.kernel.org/stable/c/b12a25fb2b9d5dac80e419d695450cc17a51fdfd"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99054", "noindex": false, "published": "2026-10-23T12:22:36.886Z", "modified": "2026-10-24T14:10:14.659Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99054", "title": "tipc: destroy topsrv workqueues before closing connections", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed w", "references": ["https://git.kernel.org/stable/c/7f796bb3b440d7f1b14c0e3b520462eb34f553af", "https://git.kernel.org/stable/c/da9c16568bc79140a54c1f5fcf07a0305df47b37", "https://git.kernel.org/stable/c/0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99052", "noindex": false, "published": "2026-10-23T12:22:34.168Z", "modified": "2026-10-23T12:22:34.168Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99052", "title": "selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts\n\nWhen an NFSv4 filesystem exported with security_label is mounted a\nsecond time, sget_fc() returns the existing superblock and\nnfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the\nsuperblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an\nearly exit without setting SECURITY_LSM_NATIVE_LABELS in\n*set_kern_flags. nfs_get_root() then sees kflags without\nSECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on\nthe shared nfs_server, silently disabling per-file labeli", "references": ["https://git.kernel.org/stable/c/a545def625860d4ccedc14fe45e884a62a041cef", "https://git.kernel.org/stable/c/a6da93c625b3557dd23ff6db45d2d1bafeae1565", "https://git.kernel.org/stable/c/5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99039", "noindex": false, "published": "2026-10-23T12:21:57.421Z", "modified": "2026-10-23T12:21:57.421Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99039", "title": "memstick: core: wait for request completion before freeing card", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: core: wait for request completion before freeing card\n\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\n\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\n\nHowever, the host co", "references": ["https://git.kernel.org/stable/c/c3ab92542475d59ae685cbb294e70ca4d0ba38e9", "https://git.kernel.org/stable/c/810580cf60edc75c9891c2de3225e4cda78e4d9f", "https://git.kernel.org/stable/c/f2795c50144d528dabc2cf2fd53c0f0c63a823a1"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99036", "noindex": false, "published": "2026-10-23T12:21:49.410Z", "modified": "2026-10-26T06:56:56.323Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99036", "title": "dm: fix reading free memory in do_resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix reading free memory in do_resume\n\nWhen do_resume calls dm_table_get_mode(new_map), the call is done without\nholding any locks (it only holds a reference to the md). It may be\npossible that another concurrent ioctl on the same device will swap table\nafter dm_swap_table and before dm_table_get_mode. In this case,\ndm_table_get_mode(new_map) reads freed memory.\n\nThis race condition was triggered by syzbot.\n\nThis commit fixes the race by reading mode of the new table before\ndm_swap_table. Note that new_map is also passed to dm_ima_need_measure,\nbut this function doesn't a", "references": ["https://git.kernel.org/stable/c/281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c", "https://git.kernel.org/stable/c/2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82", "https://git.kernel.org/stable/c/e3bf232c913b7e0103d323f15e6342d37cb1b357"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99027", "noindex": false, "published": "2026-10-23T12:21:14.896Z", "modified": "2026-10-23T12:21:14.896Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99027", "title": "net: team: stop reusing skb after queue override", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: stop reusing skb after queue override\n\nA nonzero dev_queue_xmit() result does not return ownership of the skb.\nWhen an override port's qdisc drops it, the queue override helper used to\ntry another port or the mode transmit op with the freed skb.\n\nReturn the handoff decision separately from transmit success. Select only\nthe first override port under RCU and stop after handing it the skb,\nregardless of the lower transmit result. Keep the existing success and\ndrop accounting.\n\n  BUG: KASAN: slab-use-after-free in sk_skb_reason_drop\n  Write of size 4 by task poc/5040\n", "references": ["https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a", "https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523", "https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99026", "noindex": false, "published": "2026-10-23T12:21:13.509Z", "modified": "2026-10-23T12:21:13.509Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99026", "title": "net: team: free skb when broadcast has no txable port", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: free skb when broadcast has no txable port\n\nbc_transmit() sends the original skb through the last txable port.\nWhen no port is txable, it returns false without consuming the skb, but\nteam_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the\nskb and its socket write-memory charge.\n\nA TX-enabled, link-down port keeps the broadcast transmit op installed.\nCarrier can stay up through a second link-up, TX-disabled port or be\nforced on by userspace. Free the original skb on the no-port path while\nleaving the existing drop accounting intact.\n\nDiscovered by S", "references": ["https://git.kernel.org/stable/c/961563117626f4681623077ec0cfd86f86da0d49", "https://git.kernel.org/stable/c/f34b1bcac4581a5bd3daf9eff90f175e736b54aa", "https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99019", "noindex": false, "published": "2026-10-23T12:20:55.832Z", "modified": "2026-10-23T12:20:55.832Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99019", "title": "scsi: ch: Do not keep references to data transfer element devices", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ch: Do not keep references to data transfer element devices\n\nch_readconfig() looks up the scsi_device of every data transfer element\nwhose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in\nch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops\nit: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere\nelse - it only supplies the vendor, model and revision printed in the same\nloop.\n\nOnce such a drive is removed, its scsi_device can never be released. It\nstays on the host's device list at its address, so a new device ther", "references": ["https://git.kernel.org/stable/c/ec6ecab1b7577ae555ee6b81480814d123dd9ec0", "https://git.kernel.org/stable/c/cef2cedb6f7a394b278775b3d6ffb9b20ecd61db", "https://git.kernel.org/stable/c/a34a230ccea1b8b667ae59dca11295a2c8f81738"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99010", "noindex": false, "published": "2026-10-23T12:20:35.485Z", "modified": "2026-10-23T12:20:35.485Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99010", "title": "Bluetooth: RFCOMM: free the skb when the DLC has no owner", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: free the skb when the DLC has no owner\n\nrfcomm_recv_data() hands the skb to d->data_ready() and returns 0\nwithout freeing it, so the callback owns the skb from that point on.\nThe tty implementation frees it when the DLC has been detached from its\ndevice:\n\n  static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,\n                                    struct sk_buff *skb)\n  {\n          struct rfcomm_dev *dev = dlc->owner;\n\n          if (!dev) {\n                  kfree_skb(skb);\n                  return;\n          }\n\nThe socket implementation returns without ", "references": ["https://git.kernel.org/stable/c/a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9", "https://git.kernel.org/stable/c/c3f76b025cbbb0ab47310dbe7de18092d89f2a99", "https://git.kernel.org/stable/c/4f46de658ce61968aef5ea7ae809d1c180330544"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99008", "noindex": false, "published": "2026-10-23T12:20:33.355Z", "modified": "2026-10-23T12:20:33.355Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99008", "title": "Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n\nsyzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an\nRFCOMM tty is closed.\n\nrfcomm_dev_add() puts the new device on rfcomm_dev_list first and only\nthen registers the tty device and saves it in dev->tty_dev. If that\nregistration fails, dev->tty_dev is never set at all. The device can be\nlooked up in the meantime, so an open() of /dev/rfcommN gets through\nrfcomm_tty_install() and attaches to it. When that tty is closed again,\nrfcomm_dev_shutdown() uses dev->tty_dev without checking it:\n\n ", "references": ["https://git.kernel.org/stable/c/d5c372ad03330f02962d4860df4d355ab25487df", "https://git.kernel.org/stable/c/3fd5164bdb04635caa7942ddb554b0ec699a9433", "https://git.kernel.org/stable/c/a661f401f83b8462f2d424e0a1a72b7681e92ea2"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-99002", "noindex": false, "published": "2026-10-23T12:20:22.763Z", "modified": "2026-10-24T14:09:57.241Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99002", "title": "drm/vmwgfx: validate pitch coming from userspace", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.", "references": ["https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d", "https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c", "https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}, {"id": "CVE-2026-98978", "noindex": false, "published": "2026-10-23T12:19:51.428Z", "modified": "2026-10-24T14:09:47.444Z", "cvss": 8.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.0017, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98978", "title": "namespace: never expire a locked mount", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn't.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -> x/hid", "references": ["https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c", "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644", "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}]}], "total": 4642, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/ubuntu-pro-14.04-lts/linux", "ecosystem": "Ubuntu:Pro:14.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 222, "kev": 0}, "lastmod": "2026-10-28T08:25:25.397603833Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}