p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 195

Vulnerabilities published for Operating systems in the last 30 days: 7000. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 161078

  1. CVE-2026-98846

    High · CVSS 7.3EPSS 0.16%Fix available

    sctp: check RCV_SHUTDOWN after the sendmsg connect wait

    In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the waiter breaks with err == 0 before checking asoc->base.dead. Its final sctp_association_put() can then free the association, leaving sctp_sendmsg_to_asoc() to continue with a dangling pointer. Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc() before using the association again.

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3Operating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-98845

    Low · CVSS 2.4EPSS 0.16%Fix available

    tpm: Disable TPM on null key name mismatch

    In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it finds a mismatch. The mismatch is logged: tpm tpm0: null key integrity check failed but the chip keeps serving commands: / # tpm2_getcap -c properties-fixed TPM_PT_FAMILY_INDICATOR: as UINT32: 0x08322e3000 as string: "2.0" ... tpm2_load_null() where the null key name check is run sets the

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-98844

    Medium · CVSS 4.8EPSS 0.16%Fix available

    netfs: clear post-EOF pagecache when extending a file via write

    In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region. Neither the buffered nor the unbuffered/DIO write path clears that stale pagecache. Zero the tail of the folio straddling the EOF before an extending write. That is the only folio that can hold data written past the EOF through an mmap, as pages wholly beyond the EOF can't be faulted in. The folio is zeroed rather than dropped so a concurrent e

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-98843

    Medium · CVSS 4.8EPSS 0.17%Fix available

    netfs: zero gaps in read-gaps folio to avoid writing back stale data

    In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs_read_gaps() leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later got written back. Zero it after the read completes, not before: netfs_wait_for_read() returns rreq->transferred once ret >= 0, so build an iterator over the same bvec array the read used, advance past ret, and zero the rest. The dirty region already maps to sink pages in that array rather than the real folio, so this can't touch it, and only the

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Operating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-98842

    Not ratedEPSS 0.17%Fix available

    module: fix lost error code from codetag_load_module()

    In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetag_load_module() If codetag_load_module() fails, err is not set to reflect the failure and load_module() returns 0 after the module has been torn down. Also, if the module is a livepatch, mod->klp_info allocated by copy_module_elf() leaks on this error path. Free it via a new livepatch_cleanup label.

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 6.16
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-98841

    Not ratedEPSS 0.17%Fix available

    virt: vmgenid: set driver_data before registering notification handlers

    In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver_data before registering notification handlers Both probe paths register their notification handler before assigning driver_data, which the handler dereferences. In the devicetree path, the notification IRQ can fire as soon as devm_request_irq() registers the handler: the interrupt may already be pending at probe time, for example when a VMM injects the generation-changed notification while restoring a guest from a snapshot that was taken before the driver had probed (Firecracker does exactly this on snapshot restore). The IRQ is also requested wit

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-98840

    Medium · CVSS 5.6EPSS 0.18%Fix available

    vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

    In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") sits after the 'if (ret)' block, so the copy-failure break path exits the loop without reloading vc. If the vc was kfree()'d via vc_port_destruct during the unlocked copy_from_user() window, the post-loop 'if (written && vc) vcs_scr_updated(vc)' is reached with a stale non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen: fix null-ptr-deref in vcs_notifier() du

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeOperating systems
    • Update to 5.10.273
    • Update to 5.15.224
    • Update to 6.1.191
    • Update to 6.12.113
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 6.18.56
    • Update to 6.6.160
    • Update to 7.1
    • Update to 7.2
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-98839

    Not ratedEPSS 0.17%Fix available

    vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

    In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count. Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted. When paste_

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureOperating systems
    • Update to 3.17
    • Update to 4.10
    • Update to 4.15
    • Update to 4.20
    • Update to 4.5
    • Update to 5.5
    • Update to 5.6
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-98838

    Medium · CVSS 5.7EPSS 0.18%Fix available

    vt: skip screen update for DEC alignment test on backgroup consoles

    In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 fb_pad_aligned_buffer+0x11f/0x140 ccw_putcs+0x86c/0xa80 fbcon_putcs+0x338/0x410 do_update_reg

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-98837

    High · CVSS 7.3EPSS 0.21%Fix available

    ALSA: caiaq: unregister the input device when probe fails

    In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory: BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeOperating systems
    • Update to 5.10.273
    • Update to 5.15.224
    • Update to 6.1.191
    • Update to 6.12.113
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 6.18.56
    • Update to 6.6.160
    • Update to 7.1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-98836

    High · CVSS 7EPSS 0.18%Fix available

    ALSA: line6: reject oversized playback packets

    In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT endpoint, but the number of bytes written into that slice is never compared against it. submit_audio_out_urb() takes the frame count from prev_fsize, which audio_in_callback() derived from the *IN* endpoint's received packet length, and rescales it with the playback frame size; when prev_fsize is still zero it synthesizes a length from the sample rate instead. On a device declaring a large IN wMa

    linux linux linux linux linux linux-6.12 linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edgeOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-98835

    Low · CVSS 0EPSS 0.17%Fix available

    iio: accel: kionix-kx022a: Fix array boundary check

    In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeof(array) as a last index, when last valid index should be sizeof(array) - 1. Fix the check by bailing out when index >= sizeof(array).

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-98834

    Not ratedEPSS 0.15%Fix available

    mtd: core: avoid double-free of OTP NVMEM device

    In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it.

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 5.16
    • Update to 6.2
    • Update to 6.3
    • Update to 6.4
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2026-98833

    Not ratedEPSS 0.17%Fix available

    mtd: core: call _get_device() with the master MTD

    In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() passes the master. This breaks gluebi partitions because gluebi_get_device() uses container_of() and therefore requires the master MTD. Pass the master to _get_device(), matching _put_device().

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-98832

    Medium · CVSS 5.7EPSS 0.15%Fix available

    blk-cgroup: save IRQ state in blkg_tryget_closest()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkg_tryget_closest() bio_set_dev() associates the bio with a blkg through bio_associate_blkg(). If the blkg lookup misses, blkg_tryget_closest() takes q->queue_lock with spin_lock_irq() and releases it with spin_unlock_irq(), which unconditionally enables local interrupts. Callers may call bio_set_dev() with interrupts already disabled, e.g. dm-thin's pool_map() does so while holding pool->lock taken with spin_lock_irq(). The nested spin_unlock_irq() then enables interrupts while pool->lock is still held, so an I/O completion softirq can run

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-98831

    Not ratedEPSS 0.18%Fix available

    of/overlay: don't leak fragment references when changeset init fails

    In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocat

    linux linux linux linux linux linux-6.12 linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edgeOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-98830

    Not ratedEPSS 0.21%Fix available

    wifi: wfx: validate MIB read length before copying to caller

    In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-98829

    High · CVSS 7.1EPSS 0.17%Fix available

    wifi: mac80211: drop oversized fragments to avoid extra_len overflow

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra_len overflow In ieee80211_rx_h_defragment(), fragment payloads are accumulated into entry->extra_len as subsequent fragments arrive: entry->extra_len += rx->skb->len; When the final fragment arrives, the head fragment is dequeued, and pskb_expand_head() is called with entry->extra_len to ensure sufficient tailroom for all queued fragments before copying: if (skb_tailroom(rx->skb) < entry->extra_len) { if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureOperating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-98828

    Medium · CVSS 5.1EPSS 0.2%Fix available

    wifi: ath9k: reject short WMI command responses

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9k_wmi_rsp_callback() removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that expectation can therefore be read beyond the skb payload. Record -EMSGSIZE for a short response, complete the waiter, and return the stored status from the command path. This also prevents callers from consuming stale response bytes as a successful reply.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-98827

    High · CVSS 7.3EPSS 0.2%Fix available

    wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a single tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch by record count but never by cumulative byte length. With large frames (MTU 2304), 20 aggregated frames of 2292 bytes each exceed the allocation (20 * 2296 = 45920 bytes), so the memcpy() in the loop writes up to 13152 bytes past tx_buf->buf before usb_submit_urb(). Peek the queue head and stop before copying any record that would cross MAX_TX_BUF_SIZE, then dispatch the current batch.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsOperating systems
    • Update to 6.12.113-1
    • Update to 6.12.113-1~deb12u1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →