{"kind": "product", "path": "vulns/debian-14/linux", "name": "linux", "product": "linux", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-99087", "noindex": false, "published": "2026-10-23T12:45:05.714Z", "modified": "2026-10-23T12:45:05.714Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99087", "title": "dm-integrity: fix NULL pointer dereference when the 'R' flag is used", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.", "references": ["https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f", "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956", "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99086", "noindex": false, "published": "2026-10-23T12:45:04.496Z", "modified": "2026-10-23T12:45:04.496Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99086", "title": "dm-integrity: validate the superblock on resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic->sb->log2_sectors_per_block, while ic->journa", "references": ["https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada", "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e", "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99085", "noindex": false, "published": "2026-10-23T12:45:03.465Z", "modified": "2026-10-23T12:45:03.465Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99085", "title": "sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can't pull the task back. The dying CPU goes idle with\nthe task", "references": ["https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c", "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064", "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99084", "noindex": false, "published": "2026-10-23T12:45:02.631Z", "modified": "2026-10-23T12:45:02.631Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99084", "title": "readdir: take no inode lock on an immutable directory", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreaddir: take no inode lock on an immutable directory\n\niterate_dir() takes the directory's i_rwsem shared and holds it across\n->iterate_shared(). For a directory that never has an entry and is\nnever removed the lock keeps nothing still, it only orders every reader\nand every writer of that inode behind each other.\n\nFor the directory of a nullfs instance that matters. The instance of\nthe initial mount namespace is the root of every empty mount namespace\nand the private instance is the root of every kernel thread, so one\ninode is shared across users who have nothing else in com", "references": ["https://git.kernel.org/stable/c/6d30b399ae28e5166d62484f81ccaefde6fe7996", "https://git.kernel.org/stable/c/e08f57a7dcb83818c058e415988c23beb6c5a47f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99084"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-23T12:45:01.735Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99082", "noindex": false, "published": "2026-10-23T12:45:00.798Z", "modified": "2026-10-23T12:45:00.798Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99082", "title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, sup", "references": ["https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"], "fixes": [], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99081", "noindex": false, "published": "2026-10-23T12:23:28.347Z", "modified": "2026-10-23T12:23:28.347Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99081", "title": "bnxt_en: fix DMA mapping length for padded small packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a D", "references": ["https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268", "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-23T12:23:27.393Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99079", "noindex": false, "published": "2026-10-23T12:23:26.458Z", "modified": "2026-10-23T12:23:26.458Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99079", "title": "net/mlx5e: Prevent stale XSK buffer release on refill retry", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMa", "references": ["https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208", "https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3", "https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99078", "noindex": false, "published": "2026-10-23T12:23:25.542Z", "modified": "2026-10-23T12:23:25.542Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00225, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99078", "title": "net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). ", "references": ["https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f", "https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d", "https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99077", "noindex": false, "published": "2026-10-23T12:23:22.773Z", "modified": "2026-10-23T12:23:22.773Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99077", "title": "ipv4: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless ", "references": ["https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a", "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458", "https://nvd.nist.gov/vuln/detail/CVE-2026-99077"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99076", "noindex": false, "published": "2026-10-23T12:23:19.727Z", "modified": "2026-10-23T12:23:19.727Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99076", "title": "ipv6: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less pr", "references": ["https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0", "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99076"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99075", "noindex": false, "published": "2026-10-23T12:23:18.830Z", "modified": "2026-10-23T12:23:18.830Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99075", "title": "rust_binder: reschedule node refcount update on thread exit", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: reschedule node refcount update on thread exit\n\nWhen a thread exits via BINDER_THREAD_EXIT, its pending work items are\ncancelled. If a thread exits while holding a pending node refcount\nincrement (e.g. pushed as deferred work to that thread), the refcount\nincrement was previously dropped because Node::cancel() and\nNodeWrapper::cancel() were no-ops.\n\nDropping the refcount update leaves the node's delivery state and count\nstate desynchronized, and userspace will not receive the notification,\nwhich can cause the node to never be freed from the process's nodes tree\n", "references": ["https://git.kernel.org/stable/c/71cbad138969edecef01b28dff87d91b56db538d", "https://git.kernel.org/stable/c/fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1", "https://git.kernel.org/stable/c/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99074", "noindex": false, "published": "2026-10-23T12:23:17.866Z", "modified": "2026-10-23T12:23:17.866Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99074", "title": "ipv4: stop PMTU walk when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh->nh_grp.  RCU protects each group's lifetime but\ndoes not make the loads observe the same group.  If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\nopera", "references": ["https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a", "https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87", "https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99073", "noindex": false, "published": "2026-10-23T12:23:16.935Z", "modified": "2026-10-23T12:23:16.935Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99073", "title": "ipv4: stop exception dump when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.", "references": ["https://git.kernel.org/stable/c/f91e472821e32f58b03eb631e20a67157e2b928b", "https://git.kernel.org/stable/c/21cba134c30c17ae55f468b5809336437df5d7e6", "https://git.kernel.org/stable/c/b9a30bb7b831e8c5a47fadbdf1760918aaf009cc"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99072", "noindex": false, "published": "2026-10-23T12:23:15.735Z", "modified": "2026-10-23T12:23:15.735Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99072", "title": "ipv4: stop route notification sizing when nexthop group shrinks", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, ", "references": ["https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78", "https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54", "https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99071", "noindex": false, "published": "2026-10-23T12:23:14.297Z", "modified": "2026-10-23T12:23:14.297Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99071", "title": "ipv4: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU.  With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots.  fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning.  The", "references": ["https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56", "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0", "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99070", "noindex": false, "published": "2026-10-23T12:23:13.342Z", "modified": "2026-10-23T12:23:13.342Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99070", "title": "ipv6: do not warn on route notification size race", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners.", "references": ["https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d", "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae", "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99069", "noindex": false, "published": "2026-10-23T12:23:12.396Z", "modified": "2026-10-23T12:23:12.396Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00209, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99069", "title": "Input: ati_remote2 - fix type confusion in device attribute handlers", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer ", "references": ["https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89", "https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b", "https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-99068", "noindex": false, "published": "2026-10-23T12:23:11.461Z", "modified": "2026-10-23T12:23:11.461Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99068", "title": "ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list.", "references": ["https://git.kernel.org/stable/c/f7dc71c1ce885f5d9f128037ebc75d9c0356e060", "https://git.kernel.org/stable/c/0919d8dd19f92e12829055c75fced9a454d644bf", "https://git.kernel.org/stable/c/593d46fc6af9a0178a46e77d6d24b20d2314165f"], "fixes": ["7.2.11-1"], "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}]}], "total": 19993, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/debian-14/linux", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1295, "kev": 0}, "lastmod": "2026-10-23T12:45:05.714Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}