p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 75

Vulnerabilities published for Operating systems in the last 30 days: 6567. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160309

  1. RLSA-2026:88248

    High · CVSS 8.2Fix available

    Important: expat security update

    Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    expatOperating systems
    • Update to 0:2.7.3-1.el10_2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. RLSA-2026:88207

    High · CVSS 7.5Fix available

    Important: iperf3 security update

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    iperf3Operating systems
    • Update to 0:3.17.1-6.el10_2.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-98930

    Not ratedEPSS 0.19%Fix available

    KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL. If the vCPU is already stopped, the status is stored immediately. Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue. Fix this by returning -EWOULDBLOCK from __

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureOperating systems
    • Update to 6.12.113-1
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-98929

    Not ratedEPSS 0.17%Fix available

    macsec: initialize SecY before registering the netdevice

    In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. register_netdevice() invokes inetdev_init(), which disables LRO and emits a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before macsec_add_dev() initializes the SecY. key_len is still zero, so macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in rtmsg_ifinfo_build_skb(), even though the skb has enough space. Even without the

    linux linux linux linux linux linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edge linux-oracleOperating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-98928

    Not ratedEPSS 0.17%Fix available

    KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL sve_state that the world switch loads the guest's SVE state from. Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-98927

    High · CVSS 7EPSS 0.15%Fix available

    KVM: arm64: nv: Fix life cycle of the nested_mmus array

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which implies that they may have to be relocated as the array grows. Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still be running with a pointer to the previous structure, which will have been freed. Fix this by turning the array of structures to an array of pointers, whic

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Operating systems
    • Update to 6.12.113-1
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-98926

    Not ratedEPSS 0.16%Fix available

    drm/amd/display: Remove sink usage from DPMS

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be replaced with stream->link, as the two should always be the same. [How] * Replace stream->sink->link in DPMS on/off * Add assert to USB4 BW allocation where sink is required * Avoid inconsistencies in resource access, e.g. don't repeat stream->link after it was already saved to a local variable * Pull out effective VPG calculation to helper gette

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-98925

    Not ratedEPSS 0.19%Fix available

    bpf, sockmap: Fix self-redirect copied_seq double-counting

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpOperating systems
    • Update to 6.1.189
    • Update to 6.1.190-1
    • Update to 6.12.113-1
    • Update to 6.4
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-98924

    Not ratedEPSS 0.18%Fix available

    fs: avoid repeated scans in evict_inodes()

    In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount. Each time evict_inodes() drops s_inode_list_lock to reschedule, it restarts the walk from the head of s_inodes. With many referenced inodes at the head of the list, these restarts repeatedly scan the same inodes without reclaiming them. This can keep s_umount held for a long time, blocking concurrent umount attempts and trigge

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureOperating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-98923

    Not ratedEPSS 0.17%Fix available

    arm64: io: Reject non-user protection in ioremap_prot()

    In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120 generic_access_phys() passes the protection derived from the user PTE to ioremap_prot().

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Operating systems
    • Update to 6.12.112
    • Update to 6.12.113-1
    • Update to 6.18.55
    • Update to 6.20
    • Update to 6.6.158
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-98922

    Not ratedEPSS 0.16%Fix available

    net: emac: move setting of netops to fix crash

    In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad area, sig: 11 [#1] |BE PAGE_SIZE=4K PowerPC 44x Platform |Modules linked in: |CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1 |Tainted: [W]=WARN |Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform |NIP: c0566b40 LR: c05648f8 CTR: c04c1e9c |REGS: c1053a20 TRAP: 0300 Tainted: GW (7.3.0-rc3+) |MSR: 0002b000 <CE,EE

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-98921

    Not ratedEPSS 0.16%Fix available

    ovl: fix UAF in ovl_do_mkdir() debug print

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled. Print the dentry before the call and only the result afterward.

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-98920

    Not ratedEPSS 0.17%Fix available

    netfs: Fix missing alloc tagging of direct mempool allocations

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their c

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 6.13
    • Update to 7.2
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2026-98919

    Not ratedEPSS 0.17%Fix available

    drm/xe: harden adjust_idledly() against divide-by-zero and overflow

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TI

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-98918

    Not ratedEPSS 0.16%Fix available

    mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page table walk, which hands it to damon_ptep_mkold() as the address of the page to sample: damon_va_mkold(mm, r->sampling_addr) damon_va_walk_page_range(mm, addr, addr + 1) damon_mkold_pmd_entry() damon_ptep_mkold(pte, vma, addr) ptep_test_and_clear_young(vma, addr, pte) mmu_notifier_clear_young(mm, addr, addr + PAGE

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Operating systems
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-98917

    Not ratedEPSS 0.17%Fix available

    parisc: Increase kernel stack size to 32kb

    In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vtk9 package with gcc 17: stackcheck: kworker/u128:0 will most likely overflow kernel stack (sp:179a83af0, stk bottom-top:179a80000-179a84000) Kernel panic - not syncing: low stack detected by irq handler - check messages CPU: 2 UID: 0 PID: 30760 Comm: kworker/u128:0 Tainted: G W 6.18.46-dirty #1 NONE Tainted: [W]=WARN Hardware name: 9000/800/rp3

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 4.15
    • Update to 7.2.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. SUSE-SU-2026:24382-1

    Not ratedFix available

    Security update for openssh

    This update for openssh fixes the following issues: - CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044). - CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory (bsc#1271046). - CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048). - CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (bsc#1271049). - CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052). - CVE-2026-600

    opensshOperating systems Network services
    • Update to 9.6p1-slfo.1.1_7.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-98916

    Not ratedEPSS 0.17%Fix available

    wifi: nl80211: check link is beaconing for color change

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 7.2.6-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-98915

    Not ratedEPSS 0.17%Fix available

    media: video-i2c: use vb2_video_unregister_device on driver removal

    In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 6.1.190-1
    • Update to 6.12.111-1
    • Update to 7.2.6-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-98914

    Not ratedEPSS 0.16%Fix available

    drm/amdgpu: cap ATOM command table nesting depth

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweOperating systems
    • Update to 7.2.6-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →