{"kind": "product", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "name": "linux-hwe", "product": "linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS", "items": [{"id": "CVE-2026-99215", "noindex": false, "published": "2026-10-28T10:36:08.618Z", "modified": "2026-10-28T10:36:08.618Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99215", "title": "power: supply: core: prevent unregistering a power supply while a callback runs", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after ", "references": ["https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090", "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6", "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99213", "noindex": false, "published": "2026-10-28T10:36:06.441Z", "modified": "2026-10-28T10:36:06.441Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99213", "title": "vsock: treat TCP_CLOSING as once-established", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_t", "references": ["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7", "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d", "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99212", "noindex": false, "published": "2026-10-28T10:36:05.612Z", "modified": "2026-10-28T10:36:05.612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99212", "title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect", "references": ["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99211", "noindex": false, "published": "2026-10-28T10:36:04.864Z", "modified": "2026-10-28T10:36:04.864Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99211", "title": "netlink: reset skb headers before unicast and multicast filtering", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb's network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket's\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in ", "references": ["https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d", "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47", "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99206", "noindex": false, "published": "2026-10-28T10:35:59.851Z", "modified": "2026-10-28T10:35:59.851Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99206", "title": "scsi: target: iscsi: Fix race in discovery auth updates", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.", "references": ["https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999", "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099", "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99204", "noindex": false, "published": "2026-10-28T10:35:58.336Z", "modified": "2026-10-28T10:35:58.336Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99204", "title": "ocfs2/dlm: Protect the recovery list during debugfs reads", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock,", "references": ["https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537", "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284", "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99203", "noindex": false, "published": "2026-10-28T10:35:57.589Z", "modified": "2026-10-28T10:35:57.589Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99203", "title": "pipe: preserve existing fasync readers on writer setup failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), s", "references": ["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa", "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521", "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99201", "noindex": false, "published": "2026-10-28T10:35:56.069Z", "modified": "2026-10-28T10:35:56.069Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99201", "title": "netlink: avoid hashing the network namespace pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey ", "references": ["https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99192", "noindex": false, "published": "2026-10-28T10:35:48.686Z", "modified": "2026-10-28T10:35:48.686Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99192", "title": "net: bcmgenet: unshare the skb before writing the control block", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the dri", "references": ["https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac", "https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672", "https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99181", "noindex": false, "published": "2026-10-28T10:35:34.443Z", "modified": "2026-10-28T10:35:34.443Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99181", "title": "autofs: ignore notification errors from a replaced pipe", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: ignore notification errors from a replaced pipe\n\nautofs_notify_daemon() takes a reference to the current notification\npipe under wq_mutex, then drops the mutex before writing the request. The\nwrite can block while the daemon enters catatonic mode and installs a\nreplacement pipe.\n\nIf the old pipe's reader is then closed, the delayed write returns -EPIPE\nand the generic error path enters catatonic mode again. That transition\nacts on the current superblock state, closes the replacement pipe, and\nreleases the new daemon generation's wait queues.\n\nOnly enter catatonic mod", "references": ["https://git.kernel.org/stable/c/1a177064f501ed4b67873a43aae5d5bdb18b3704", "https://git.kernel.org/stable/c/fb296391f685d82dbb93621a970fb234cea45280", "https://git.kernel.org/stable/c/65676cd4203c0e41a94caf54080a7f0a95434bda"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99178", "noindex": false, "published": "2026-10-28T10:35:31.961Z", "modified": "2026-10-28T10:35:31.961Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99178", "title": "x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context\n\nAn async #PF \"page not present\" event arrives through the #PF vector,\nand its reason sits in the per-CPU apf_reason.flags until\n__kvm_handle_async_pf() reads and clears it. If an NMI arrives after\nthe event is injected and before the #PF handler reads the flags, and\nthe NMI handler itself takes a #PF, that fault reads and clears the\nflags belonging to the #PF it interrupted. It then finds interrupts\ndisabled in the NMI context it interrupted, and panics:\n\n  Kernel panic - not syncing: Host injected async ", "references": ["https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921", "https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9", "https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99176", "noindex": false, "published": "2026-10-28T10:35:30.615Z", "modified": "2026-10-28T10:35:30.615Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00191, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99176", "title": "KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry\n\nReset the vCPU's MMU pointer back to the root MMU if loading L2 state fails\nin the \"not from VM-Entry\" case, i.e. when emulating RSM or handling\nKVM_SET_NESTED_STATE.  Failure to unwind the MMU pointer results in KVM\ntrying to run L1 with a nested MMU, and is especially problematic if the\nvCPU manages to free its nested state before the VM crashes.  Constructing\nthe root for a nested EPT MMU goes through vmcs12, which is dynamically\nallocated/freed when nVMX is enabled/disabled.  And so if the", "references": ["https://git.kernel.org/stable/c/d00d5f534a8238674755e59826a6c7d3c8efb870", "https://git.kernel.org/stable/c/c9716f956216eb74ab0aad7f633586edd49e0322", "https://git.kernel.org/stable/c/c8f4cfe1cf93bce924e27f2abead7a4c4a487505"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99175", "noindex": false, "published": "2026-10-28T10:35:29.760Z", "modified": "2026-10-28T10:35:29.760Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99175", "title": "fsnotify: prevent mark additions during connector teardown", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: prevent mark additions during connector teardown\n\nfsnotify_destroy_marks() keeps a reference to its current mark while it\ndrops conn->lock to destroy the mark. This stabilizes the forward-walk\ncursor, but does not prevent a new mark from being inserted before it.\nFor example, an inotify watch re-added after IN_IGNORED sorts before the\nold, detached mark for the same group. The walk can miss the replacement\nand then detach the entire connector from the object.\n\nThe replacement is still on its group's marks_list and, for inotify, in\nthe watch IDR. The group mutex no ", "references": ["https://git.kernel.org/stable/c/952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1", "https://git.kernel.org/stable/c/472589eacdf10b5f9bd10b333957ed5291b2544b", "https://git.kernel.org/stable/c/36ebddca56b9d8993d6dc984fdecc748ee1f5e06"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99166", "noindex": false, "published": "2026-10-28T10:35:18.050Z", "modified": "2026-10-28T10:35:18.050Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99166", "title": "net: rds: fix uninitialized trans dereference in CM event handler", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix uninitialized trans dereference in CM event handler\n\nrds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA\ndevice is an InfiniBand CA (RDMA_NODE_IB_CA).  On any other device\ntype, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but\nthe event switch dereferences it: unconditionally in the\nRDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),\nand (with a connection context) in the ROUTE_RESOLVED and\nESTABLISHED cases.\n\nAn RDS listener on an iWARP device therefore crashes the kernel as\nsoon as a connect request arrives: with CONF", "references": ["https://git.kernel.org/stable/c/5f23e4e3a31dacfd82a8f56be253adc0910ee84f", "https://git.kernel.org/stable/c/ca14c289ed9ffed6cc64290d039e923e5720a8bf", "https://git.kernel.org/stable/c/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99161", "noindex": false, "published": "2026-10-28T10:35:13.970Z", "modified": "2026-10-28T10:35:13.970Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99161", "title": "i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()\n\nIn wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any\nsubsequent operation fails or when the module is unloaded, the clock\nreference count is never decremented via clk_put(), leading to a\nresource leak.\n\nSwitch to devm_clk_get() so that the clock is automatically managed\nand released.", "references": ["https://git.kernel.org/stable/c/5d476bb76b7d72d8b7ed04a9c614900b097e3af7", "https://git.kernel.org/stable/c/1875de656370c89b99a150d220df876288ee0344", "https://git.kernel.org/stable/c/aaabefc79b0ff0018e8e3832169bbe359d0551fc"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99156", "noindex": false, "published": "2026-10-28T10:35:10.493Z", "modified": "2026-10-28T10:35:10.493Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99156", "title": "scsi: st: Fix use-after-free race between st_remove() and st_open()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() ", "references": ["https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822", "https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5", "https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99154", "noindex": false, "published": "2026-10-28T10:35:08.968Z", "modified": "2026-10-28T10:35:08.968Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99154", "title": "scsi: libiscsi: Reject a negative task index from parse_pdu_itt", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Reject a negative task index from parse_pdu_itt\n\nA transport that implements parse_pdu_itt hands libiscsi an index taken\nfrom the PDU, and both lookups bound it from above only:\n\n      if (i >= session->cmds_max)\n\ni and cmds_max are both int, so a negative index passes and\nsession->cmds[i] is read from before the array.\n\nbe2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,\n\n      *index = (int)itt;\n\nand beiscsi_complete_pdu() forwards an unsolicited NOP-In from the\nhardware async ring without replacing its ITT, so the value is the\ntarget's. It also", "references": ["https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e", "https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7", "https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99153", "noindex": false, "published": "2026-10-28T10:35:08.287Z", "modified": "2026-10-28T10:35:08.287Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99153", "title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NUL", "references": ["https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8", "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a", "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99152", "noindex": false, "published": "2026-10-28T10:35:07.622Z", "modified": "2026-10-28T10:35:07.622Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99152", "title": "scsi: libiscsi: Validate the task named by a management response", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n      case ISCSI_OP_LOGOUT_RSP:\n      case ISCSI_OP_LOGIN_RSP:\n      case ISCSI_OP_TEXT_RSP:\n      case ISCSI_OP_SCSI_TMFUNC_RSP:\n      case ISCSI_OP_NOOP_IN:\n              task = iscsi_itt_to_task(conn, hdr->itt);\n              if (!task)\n                      return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any", "references": ["https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936", "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860", "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}, {"id": "CVE-2026-99136", "noindex": false, "published": "2026-10-28T10:34:48.558Z", "modified": "2026-10-28T10:34:48.558Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99136", "title": "dm-crypt: fix a tiny race condition in crypt_dec_pending", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io->error before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io->error and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destru", "references": ["https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3", "https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8", "https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6"], "fixes": [], "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}]}], "total": 7057, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-hwe", "path": "vulns/ubuntu-pro-16.04-lts/linux-hwe", "ecosystem": "Ubuntu:Pro:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 394, "kev": 0}, "lastmod": "2026-10-28T10:36:08.618Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}