{"kind": "product", "path": "vulns/debian-12/linux", "name": "linux", "product": "linux", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-99087", "noindex": false, "published": "2026-10-23T12:45:05.714Z", "modified": "2026-10-23T12:45:05.714Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99087", "title": "dm-integrity: fix NULL pointer dereference when the 'R' flag is used", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.", "references": ["https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f", "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956", "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99086", "noindex": false, "published": "2026-10-23T12:45:04.496Z", "modified": "2026-10-23T12:45:04.496Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99086", "title": "dm-integrity: validate the superblock on resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic->sb->log2_sectors_per_block, while ic->journa", "references": ["https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada", "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e", "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-24T14:10:24.950Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99082", "noindex": false, "published": "2026-10-23T12:45:00.798Z", "modified": "2026-10-24T14:10:23.875Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99082", "title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, sup", "references": ["https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99081", "noindex": false, "published": "2026-10-23T12:23:28.347Z", "modified": "2026-10-24T14:10:22.790Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99081", "title": "bnxt_en: fix DMA mapping length for padded small packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a D", "references": ["https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268", "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-23T12:23:27.393Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99077", "noindex": false, "published": "2026-10-23T12:23:22.773Z", "modified": "2026-10-24T14:10:19.075Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.0021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99077", "title": "ipv4: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless ", "references": ["https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a", "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458", "https://nvd.nist.gov/vuln/detail/CVE-2026-99077"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99076", "noindex": false, "published": "2026-10-23T12:23:19.727Z", "modified": "2026-10-23T12:23:19.727Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99076", "title": "ipv6: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less pr", "references": ["https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0", "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99076"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99074", "noindex": false, "published": "2026-10-23T12:23:17.866Z", "modified": "2026-10-23T12:23:17.866Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99074", "title": "ipv4: stop PMTU walk when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh->nh_grp.  RCU protects each group's lifetime but\ndoes not make the loads observe the same group.  If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\nopera", "references": ["https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a", "https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87", "https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99072", "noindex": false, "published": "2026-10-23T12:23:15.735Z", "modified": "2026-10-23T12:23:15.735Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99072", "title": "ipv4: stop route notification sizing when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, ", "references": ["https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78", "https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54", "https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99071", "noindex": false, "published": "2026-10-23T12:23:14.297Z", "modified": "2026-10-23T12:23:14.297Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99071", "title": "ipv4: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU.  With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots.  fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning.  The", "references": ["https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56", "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0", "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99070", "noindex": false, "published": "2026-10-23T12:23:13.342Z", "modified": "2026-10-23T12:23:13.342Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99070", "title": "ipv6: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners.", "references": ["https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d", "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae", "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99067", "noindex": false, "published": "2026-10-23T12:23:10.430Z", "modified": "2026-10-23T12:23:10.430Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99067", "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "references": ["https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6", "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99063", "noindex": false, "published": "2026-10-23T12:23:04.655Z", "modified": "2026-10-23T12:23:04.655Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99063", "title": "dm ioctl: don't let data_start run past the buffer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n  Read o", "references": ["https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920", "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61", "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99061", "noindex": false, "published": "2026-10-23T12:22:59.770Z", "modified": "2026-10-23T12:22:59.770Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99061", "title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the ", "references": ["https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163", "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f", "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99059", "noindex": false, "published": "2026-10-23T12:22:47.559Z", "modified": "2026-10-24T14:10:16.832Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99059", "title": "wireguard: noise: reject response consumption after intermediate initiation", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it's running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that's already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which p", "references": ["https://git.kernel.org/stable/c/fb5ce4c7790c3eeec820302d08d70ecf46af4295", "https://git.kernel.org/stable/c/c76a80db593096edf2b3b3972f58b6342a8c6c04", "https://git.kernel.org/stable/c/4d64a3d6e96aa78619c9c29ffde309794974588a"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99058", "noindex": false, "published": "2026-10-23T12:22:45.920Z", "modified": "2026-10-23T12:22:45.920Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00225, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99058", "title": "workqueue: Fix NULL current_pwq deref in chained work check", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker->current_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker->current_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarni", "references": ["https://git.kernel.org/stable/c/3dc61af2998cfc7312d6e59bbdcd5eed074483f2", "https://git.kernel.org/stable/c/729d576df89c7e4341e58c452f8890620a610ac2", "https://git.kernel.org/stable/c/b12a25fb2b9d5dac80e419d695450cc17a51fdfd"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99057", "noindex": false, "published": "2026-10-23T12:22:44.683Z", "modified": "2026-10-23T12:22:44.683Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99057", "title": "xen/netfront: don't leak the skb when xennet_fill_frags() fails", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above ", "references": ["https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089", "https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2", "https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99056", "noindex": false, "published": "2026-10-23T12:22:42.234Z", "modified": "2026-10-24T14:10:15.756Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99056", "title": "strparser: make sure __strp_recv isn't running before tearing down the parser", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from ->sk_data_ready or strp_work)\nhas completed.\n\nOnly espi", "references": ["https://git.kernel.org/stable/c/a18dd388045dc7263d99a07db9de4e0f149ca8f1", "https://git.kernel.org/stable/c/9f3e9fe1b155e9b4572054d8d140586bc3512ecf", "https://git.kernel.org/stable/c/d2b5f637b9b67a79a50d42614d10653c13b4e449"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-99054", "noindex": false, "published": "2026-10-23T12:22:36.886Z", "modified": "2026-10-24T14:10:14.659Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99054", "title": "tipc: destroy topsrv workqueues before closing connections", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed w", "references": ["https://git.kernel.org/stable/c/7f796bb3b440d7f1b14c0e3b520462eb34f553af", "https://git.kernel.org/stable/c/da9c16568bc79140a54c1f5fcf07a0305df47b37", "https://git.kernel.org/stable/c/0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}]}], "total": 15125, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/debian-12/linux", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 819, "kev": 0}, "lastmod": "2026-10-24T14:10:24.950Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}