{"kind": "product", "path": "vulns/debian-12/linux-6.12", "name": "linux-6.12", "product": "linux-6.12", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-98862", "noindex": false, "published": "2026-10-18T15:51:23.224Z", "modified": "2026-10-21T12:57:38.560Z", "cvss": 7.1, "cvss_vector": "", "severity": "high", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98862", "title": "audit: fix exe mark UAF in kill_rules()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\n\nKASAN reports:\n\n    BUG: KASAN: slab-use-after-free in audit", "references": ["https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867", "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8", "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98860", "noindex": false, "published": "2026-10-18T15:51:21.403Z", "modified": "2026-10-19T09:26:54.770Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98860", "title": "HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size in", "references": ["https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee", "https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9", "https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98859", "noindex": false, "published": "2026-10-18T15:51:20.456Z", "modified": "2026-10-21T12:57:37.465Z", "cvss": 5.4, "cvss_vector": "", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98859", "title": "HID: multitouch: stop the release timer from being rearmed on remove", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: stop the release timer from being rearmed on remove\n\nmt_remove() quiesces the sticky-finger timer before stopping the\nhardware:\n\n    timer_delete_sync(&td->release_timer);\n\n    sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);\n    hid_hw_stop(hdev);\n\ntimer_delete_sync() waits for a running callback and dequeues the timer,\nbut it does not stop the timer from being armed again. The transport is\nstill delivering reports at that point, and the report path rearms it:\n\n    if (app->quirks & MT_QUIRK_STICKY_FINGERS) {\n        if (td->mt_io_flags & MT_IO_SLO", "references": ["https://git.kernel.org/stable/c/3776f34fbce990af45978f1628d2e1adc0d67d0f", "https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a", "https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98858", "noindex": false, "published": "2026-10-18T15:51:19.578Z", "modified": "2026-10-19T09:26:52.852Z", "cvss": 7.3, "cvss_vector": "", "severity": "high", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98858", "title": "io_uring: fix task_work add use-after-free with SQPOLL", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix task_work add use-after-free with SQPOLL\n\nFor SQPOLL, the sqpoll thread runs task_work off its own list and\ndoesn't need to be told about it, so it can pop and complete a request\nas soon as mpscq_push() has published it. If that was the last request\nholding the ring alive, io_ring_exit_work() then frees the ctx, stops\nthe thread, and with it the tctx, while io_req_normal_work_add() is\nstill looking at both after the push:\n\n  BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510\n  Read of size 4 at addr ff11000000ca0000 by task repro/55\n  (...)\n ", "references": ["https://git.kernel.org/stable/c/42b3332efacfd2140be4cd0dedad4fb96b8ae90e", "https://git.kernel.org/stable/c/891bd8335a0de3bb15c3b797ce3026bbb0dbef6c", "https://git.kernel.org/stable/c/395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98857", "noindex": false, "published": "2026-10-18T15:51:17.262Z", "modified": "2026-10-21T12:57:36.378Z", "cvss": 6.8, "cvss_vector": "", "severity": "medium", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98857", "title": "ipvs: bound LBLCR and LBLC cache growth", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic th", "references": ["https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa", "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300", "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98856", "noindex": false, "published": "2026-10-18T15:51:12.359Z", "modified": "2026-10-21T12:57:35.270Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00169, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98856", "title": "kprobes: Skip disarmed probes when checking optkprobe overlap", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:\n\n              A    A+1  A+2  A+3  A+4\n  A's jump  | e9 | d0 | d1 | d2 | d3 |\n  after C   | e9 | d0 | d1 | d2 | cc |\n\nThe INT3 for C overwrites the last byte of A's jump displacement, so\nexecution can jump to the wrong address. B can have prepared optinsns\nwhile disarmed, but has no jump to unoptimize.\n\nContinue past disarmed and unp", "references": ["https://git.kernel.org/stable/c/3f968dcdf018861129f97910fa7bd680d939a9b0", "https://git.kernel.org/stable/c/985a568171e7bdba6dcde3420d0e5bb515813457", "https://git.kernel.org/stable/c/6745fa65f4115045431c0c15610e876855a04625"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98855", "noindex": false, "published": "2026-10-18T15:51:09.970Z", "modified": "2026-10-21T12:57:34.195Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98855", "title": "of/overlay: put property on deadprops only after changeset add succeeds", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: put property on deadprops only after changeset add succeeds\n\nadd_changeset_property() links a new property of a not-yet-live\ntarget node into the node's deadprops list before handing it to\nof_changeset_add_property(). If that fails, the error path frees the\nproperty but leaves the freed pointer linked in deadprops, and\nof_node_release() frees it a second time when the aborted overlay's\nnode is released.\n\nRecord the changeset entry first and link the property into deadprops\nonly on success. of_changeset_add_property() never looks at the\nnode's property lists, so t", "references": ["https://git.kernel.org/stable/c/936f1ffcb87a1c50938a21176a6463af162cf4b5", "https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a", "https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98854", "noindex": false, "published": "2026-10-18T15:51:06.167Z", "modified": "2026-10-21T12:57:33.107Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98854", "title": "of/overlay: only treat a positive changeset id as registered", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initia", "references": ["https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d", "https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39", "https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98852", "noindex": false, "published": "2026-10-18T15:50:55.946Z", "modified": "2026-10-21T12:57:32.027Z", "cvss": 6.8, "cvss_vector": "", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98852", "title": "net: extend IPv6 exthdr detection of tunneled packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: extend IPv6 exthdr detection of tunneled packets\n\nCommit c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM\nGSO fallback\") split skb_gso_has_extension_hdr() into mutually exclusive\nbranches on skb->encapsulation. This did not yet address all paths:\n\n1. With skb->encapsulation set, the outer header is not checked. IPv6\n   tunnels such as ip6_gre and ip6_tunnel add an outer Destination\n   Options header by default (encap_limit). Their GSO packets skip\n   software GSO, then skb_csum_hwoffload_help() sees the outer extension\n   header and calls skb_checksum_", "references": ["https://git.kernel.org/stable/c/fdbd83c2d929ec968b37d2f75149a79440e328ff", "https://git.kernel.org/stable/c/44ba9dc568c878b699d05e7cf699572dc9df4b59", "https://git.kernel.org/stable/c/aa480f05aed7a9eee87d4a6fc90647fe9679c670"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98851", "noindex": false, "published": "2026-10-18T15:50:50.910Z", "modified": "2026-10-21T12:57:30.875Z", "cvss": 2, "cvss_vector": "", "severity": "low", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98851", "title": "netfilter: nft_flow_offload: drop flowtable reference on init error path", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get().  When the latter\nfails, the error is returned as-is and the reference is leaked.\n\nThe upper layers do not balance it either: nf_tables_newexpr()\nclears expr->ops when the expression init callback fails, so the\nnft_expr_more() iteration in nft_rule_expr_deactivate() and\nnf_tables_rule_destroy() stops right before the failed expression\nand its ->destroy callback, which would drop the reference, neve", "references": ["https://git.kernel.org/stable/c/1d27214fd9a4d2c0c6d998fc9d4fb61448a3438e", "https://git.kernel.org/stable/c/64ac0cb574c740bf723affb79b646eeba920db6b", "https://git.kernel.org/stable/c/c5f91098edee98c015f78488460a0609e62582a5"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98850", "noindex": false, "published": "2026-10-18T15:50:50.062Z", "modified": "2026-10-21T12:57:29.795Z", "cvss": 5.7, "cvss_vector": "", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98850", "title": "net/packet: prevent TX_RING byte count overflow", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on", "references": ["https://git.kernel.org/stable/c/ae169d318d5d23bac76ece90a7e2b5cb760ed043", "https://git.kernel.org/stable/c/be12b221c0301111eeb023be04add3c6ad7c21fe", "https://git.kernel.org/stable/c/69ca64bbb528898916f309552053c32a04a36ebc"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98849", "noindex": false, "published": "2026-10-18T15:50:48.743Z", "modified": "2026-10-19T09:26:41.559Z", "cvss": 5.7, "cvss_vector": "", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98849", "title": "pfcp: fix socket lifetime on netdevice registration failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: fix socket lifetime on netdevice registration failure\n\npfcp_newlink() creates the UDP socket before register_netdevice().\nIf registration fails after pfcp_dev_init() succeeds, the core calls\npfcp_dev_uninit(), which releases the socket and clears pfcp->sk.\nThe newlink error path then releases it again, causing a NULL pointer\ndereference. This was observed with failslab fault injection:\n\n  FAULT_INJECTION: forcing a failure.\n  kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)\n  BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50\n  Read ", "references": ["https://git.kernel.org/stable/c/dcb8f6a79c3360a440c399d85df465a6e59351f1", "https://git.kernel.org/stable/c/4b8ce1686dea1a10805a0807bf492409b0300ee1", "https://git.kernel.org/stable/c/2cee3603ec1d9b5ec7f2121ea3efe9488e906f46"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98848", "noindex": false, "published": "2026-10-18T15:50:47.105Z", "modified": "2026-10-21T12:57:28.688Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98848", "title": "rtc: ac100: Assign .num before accessing .hws", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Assign .num before accessing .hws\n\nCommit f316cdff8d67 (\"clk: Annotate struct clk_hw_onecell_data with\n__counted_by\") annotated the hws member of 'struct clk_hw_onecell_data'\nwith __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)\nabout the number of elements in .hws[], so that it can warn when .hws[]\nis accessed out of bounds. As noted in that change, the __counted_by\nmember must be initialized with the number of elements before the first\narray access happens, otherwise there will be a warning from each access\nprior to the initialization because the", "references": ["https://git.kernel.org/stable/c/e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef", "https://git.kernel.org/stable/c/6bb55381daf1a1bed0657189a1396e7467712525", "https://git.kernel.org/stable/c/160619b38707241e22569f9c983a4b3d0890996a"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98847", "noindex": false, "published": "2026-10-18T15:50:40.825Z", "modified": "2026-10-21T12:57:27.585Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98847", "title": "rtc: spear: initialize IRQ state before requesting alarm IRQ", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: spear: initialize IRQ state before requesting alarm IRQ\n\ndevm_request_irq() enables the interrupt before it returns, so the handler\nmay run while probe is still initializing the device. Initialize the MMIO\naddress and spinlock before requesting the alarm IRQ.", "references": ["https://git.kernel.org/stable/c/aeda50d645bbb55241be840602e338b3a16c24ca", "https://git.kernel.org/stable/c/c02aa67ea34a826c2cb1aa65d77cf32fafb7eec3", "https://git.kernel.org/stable/c/e0cabda9b6f4dd276c55c40bdbb251e8507ae60e"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98846", "noindex": false, "published": "2026-10-18T15:50:34.714Z", "modified": "2026-10-21T12:57:26.471Z", "cvss": 7.3, "cvss_vector": "", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98846", "title": "sctp: check RCV_SHUTDOWN after the sendmsg connect wait", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err == 0 before checking\nasoc->base.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. ", "references": ["https://git.kernel.org/stable/c/1bef1944ef15a40797305bf916827b04df6307ca", "https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd", "https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98845", "noindex": false, "published": "2026-10-18T15:50:27.596Z", "modified": "2026-10-19T09:26:37.375Z", "cvss": 2.4, "cvss_vector": "", "severity": "low", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98845", "title": "tpm: Disable TPM on null key name mismatch", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Disable TPM on null key name mismatch\n\nThe null key name check exists to protect against TPM reset attacks, so\na mismatch should stop the device from serving further requests.\nCurrently it does not disable the chip when it finds a mismatch.\n\nThe mismatch is logged:\n\n    tpm tpm0: null key integrity check failed\n\nbut the chip keeps serving commands:\n\n    / # tpm2_getcap -c properties-fixed\n    TPM_PT_FAMILY_INDICATOR:\n      as UINT32:                0x08322e3000\n      as string:                \"2.0\"\n    ...\n\ntpm2_load_null() where the null key name check is run sets the ", "references": ["https://git.kernel.org/stable/c/a03d0c64cd827a622578623a78defd66b6593b82", "https://git.kernel.org/stable/c/96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa", "https://git.kernel.org/stable/c/f6599d8830fe7ddab7334cc17846fd9ac9a7fa50"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98844", "noindex": false, "published": "2026-10-18T15:50:25.256Z", "modified": "2026-10-19T09:26:36.394Z", "cvss": 4.8, "cvss_vector": "", "severity": "medium", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98844", "title": "netfs: clear post-EOF pagecache when extending a file via write", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: clear post-EOF pagecache when extending a file via write\n\nFix netfs to erase the contents of a hole created after the EOF by an\nordinary write if dirty data has been previously left there by writes\nthrough an mmapped region.  Neither the buffered nor the unbuffered/DIO\nwrite path clears that stale pagecache.\n\nZero the tail of the folio straddling the EOF before an extending\nwrite.  That is the only folio that can hold data written past the EOF\nthrough an mmap, as pages wholly beyond the EOF can't be faulted in.\nThe folio is zeroed rather than dropped so a concurrent e", "references": ["https://git.kernel.org/stable/c/f8f7d86b3537e885ee620898a38b749fba8a8456", "https://git.kernel.org/stable/c/98f6a4589e0f5f6cf819b8dd45605efc481c06ce", "https://git.kernel.org/stable/c/a7036a73671fc83d299bc770710fe996d9fef9ca"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98841", "noindex": false, "published": "2026-10-18T15:50:15.224Z", "modified": "2026-10-19T09:26:33.492Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98841", "title": "virt: vmgenid: set driver_data before registering notification handlers", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: vmgenid: set driver_data before registering notification handlers\n\nBoth probe paths register their notification handler before assigning\ndriver_data, which the handler dereferences.\n\nIn the devicetree path, the notification IRQ can fire as soon as\ndevm_request_irq() registers the handler: the interrupt may already be\npending at probe time, for example when a VMM injects the\ngeneration-changed notification while restoring a guest from a snapshot\nthat was taken before the driver had probed (Firecracker does exactly\nthis on snapshot restore). The IRQ is also requested wit", "references": ["https://git.kernel.org/stable/c/538fe5efaa9704ad820ba34b4f9df135ca873d79", "https://git.kernel.org/stable/c/7a1e8daeaa466c6aaffa223e1afe9cfeece0dd47", "https://git.kernel.org/stable/c/8f42954ad8bf9bdbf574f2c437ad30cb2601f401"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98840", "noindex": false, "published": "2026-10-18T15:50:14.029Z", "modified": "2026-10-21T12:57:25.411Z", "cvss": 5.6, "cvss_vector": "", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98840", "title": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() du", "references": ["https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0", "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1", "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-98838", "noindex": false, "published": "2026-10-18T15:50:07.004Z", "modified": "2026-10-21T12:57:24.278Z", "cvss": 5.7, "cvss_vector": "", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98838", "title": "vt: skip screen update for DEC alignment test on backgroup consoles", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: skip screen update for DEC alignment test on backgroup consoles\n\n[BUG]\nRecently, we encountered a KASAN warning as follows:\n\nBUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140\nRead of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239\nCPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nCall Trace:\n <TASK>\n ...\n kasan_report+0xf0/0x120\n fb_pad_aligned_buffer+0x11f/0x140\n ccw_putcs+0x86c/0xa80\n fbcon_putcs+0x338/0x410\n do_update_reg", "references": ["https://git.kernel.org/stable/c/2fc4e71aefab57c80ccc9775aad2af503fc90810", "https://git.kernel.org/stable/c/985c000b046ca4ee11ee34ef85db500c569ef6e8", "https://git.kernel.org/stable/c/ad06f7312d3f615dd466483ce81a9b9619166686"], "fixes": ["6.12.113-1~deb12u1"], "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}]}], "total": 2889, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 145, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-6.12", "path": "vulns/debian-12/linux-6.12", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 484, "kev": 0}, "lastmod": "2026-10-21T12:57:38.560Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}