p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 73

Vulnerabilities published for Operating systems in the last 30 days: 6553. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160295

  1. CVE-2026-98949

    Not ratedEPSS 0.17%Fix available

    drm/imagination: Fix reference and vm_bo handling in remap()

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating something new. It gets two things wrong. - A GEM reference is taken for each part but it's never needed and never dropped, so it leaks one reference per split (remap-next-in-2m in tests/imagination/pvr_vm_map.c): CRITICAL: 33558528 bytes of shmem still held after close - The parts still belong to the original object being split, but p

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Operating systems
    • Update to 6.12.113-1
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-98948

    Not ratedEPSS 0.17%Fix available

    mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_fl

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Operating systems
    • Update to 6.12.113-1
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-98947

    Not ratedEPSS 0.17%Fix available

    vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the __release_sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak. sock_close __sock_release __vsock_release // take ownership by user-space lock_sock_nested sock_set_flag(sk, SOCK_DEAD) vmci_transport_release

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-98946

    Not ratedEPSS 0.16%Fix available

    drm/vc4: Disable the V3D interrupt across runtime suspend

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, wh

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-98945

    High · CVSS 7.8EPSS 0.16%Fix available

    HID: steam: Rearrange teardown sequence

    In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-98944

    High · CVSS 7.8EPSS 0.18%Fix available

    HID: steam: Refactor registration

    In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could ge

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 4.20
    • Update to 6.12.113-1
    • Update to 7.2.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-98942

    Not ratedEPSS 0.16%Fix available

    sched_ext: Build the cid tables privately and publish them with RCU

    In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init_cids() overrides rewrite them in place, and re-enables rebuild them in place. A racing TRACING or SYSCALL program can read unfilled entries, including uninitialized memory in the kmalloc'd tables, or torn topo updates. Tie the tables' lifetimes to the root sched instead: each root enable builds a fresh set privately and publishes the per-table __rcu globals once th

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. openSUSE-SU-2026:22159-1

    Not ratedFix available

    Security update for mozilla-nss, MozillaFirefox

    This update for mozilla-nss, MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.5.1 ESR (MFSA 2026-112, bsc#1286385): - CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).

    mozillafirefox mozilla-nssOperating systems
    • Update to 153.5.1-160000.1.1
    • Update to 3.125-160000.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-98941

    High · CVSS 7EPSS 0.14%Fix available

    ext4: don't enable large folios on encrypted inodes

    In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:ext4_finish_bio+0xf7/0x3e0 Call Trace: ext4_release_io_end+0x51/0x110 ext4_end_io_end+0x4c/0xe0 ext4_

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-98940

    Not ratedEPSS 0.17%Fix available

    ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

    In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver. When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code currently uses dai_id to index variant->dai_driver. This is incorrect for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S DAI has ID 4 while it is the only entry in the DAI driver table. If that DAI is configured for QUAD01 and probe reaches this branch, the code writes beyond that single entry via dai_dri

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-98939

    Not ratedEPSS 0.17%Fix available

    x86/mm: Drop unnecessary PMD page copy when freeing

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page protection munging code. The huge vmap code holds the same lock over a GFP_KERNEL allocation, which is a no-no now that reclaim can take it. That allocation is in a page table *free* path and ends up being for dubious purposes[1]. Basically, it tries to avoid hardware setting Accessed=1 in page table entries that are unreachable by

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 6.18.56
    • Update to 7.2.10
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. RLSA-2026:88455

    Medium · CVSS 6.8Fix available

    Critical: ca-certificates security update

    The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    ca-certificatesOperating systems
    • Update to 0:2026.2.92_v9.0.319-100.3.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-98938

    Not ratedEPSS 0.16%Fix available

    rust: irq: pass RegistrationInner as cookie to request_irq

    In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory. Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields ar

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-98937

    Not ratedEPSS 0.17%Public exploitFix available

    perf/core: Check kernel access when kernel callchains are requested

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and pr

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-98936

    Not ratedEPSS 0.18%Fix available

    wifi: ath11k: reset ar->num_stations on hardware start

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too. This avoids problems like those: [1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-98935

    Not ratedEPSS 0.18%Fix available

    rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

    In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked. Zero-initialize the struct at declaration to eliminate this information leak risk. Fixes smatch warnings: - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3 linux-azure-5.4Operating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-98934

    Not ratedEPSS 0.18%Fix available

    ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer. syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1. seg6_make_flowlabel() alre

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3 linux-azure-5.4Operating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-98933

    Not ratedEPSS 0.18%Fix available

    usb: hub: use shorter 120ms post resume hold for SS root hubs

    In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details. Reducing the hold time to 120ms for the USB3 roothub is in itself a valid chang

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 5.10.273
    • Update to 5.15.224
    • Update to 5.5
    • Update to 6.1.191
    • Update to 6.12.113
    • Update to 6.12.113-1
    • Update to 6.16
    • Update to 6.6.160
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-98932

    High · CVSS 7.4EPSS 0.18%Fix available

    EDAC/altera: Fix use-after-free in error paths

    In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an IRQ firing between freeing dci and unregistering the IRQs could dereference the freed memory. Release the devres group first so the managed IRQs are unregistered before the dci structure is freed.

    linux linux linux linux linux linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edge linux-oracleOperating systems
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-98931

    Not ratedEPSS 0.17%Fix available

    mtd: spinand: fix NULL pointer dereference with no ECC engine

    In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it unconditionally to test for a pipelined engine, so probing such a device oopses immediately. Rather than open-coding the test three times, add a nand_ecc_is_pipelined() helper to the NAND core that folds the NULL check into the integration comparison, and use it everywhere. Future callers then cannot reint

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →