{"kind": "product", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "name": "linux-kvm", "product": "linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS", "items": [{"id": "CVE-2026-99095", "noindex": false, "published": "2026-10-26T14:52:02.647Z", "modified": "2026-10-26T14:52:02.647Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99095", "title": "drm/vc4: drain the hangcheck timer and works on V3D unbind", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interrupt queues, at teardown:\nvc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()\nruns from the drm-managed release, after vc4_v3d_unbind() has already\nuninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed\nby then reads V3D registers through the NULL vc4->v3d pointer, and the\nlate callbacks run on the vc4_dev embedding them after it has been\nfreed.\n\nDrain them in vc4_v3d_unbind(", "references": ["https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240", "https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731", "https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99090", "noindex": false, "published": "2026-10-26T14:51:59.654Z", "modified": "2026-10-27T15:53:00.938Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99090", "title": "drm/amdgpu: serialize vblank counter reads against GPU reset", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: serialize vblank counter reads against GPU reset\n\nThe vblank counter callback reads display registers and scanout\nposition without holding reset_domain->sem. During GPU recovery,\ndisplay commit work can call the callback while reset owns the\nsemaphore for writing. The hardware access then triggers the\nlockdep_assert_held() in amdgpu_device_skip_hw_access() and sets\nTAINT_WARN when lockdep is enabled.\n\nTry to acquire the reset semaphore for reading before accessing the\nhardware, and hold it across the counter and scanout-position reads.\nIf reset is already in prog", "references": ["https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5", "https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e", "https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99089", "noindex": false, "published": "2026-10-26T14:51:59.055Z", "modified": "2026-10-26T14:51:59.055Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99089", "title": "ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n\nThe probe function puts the device into the runtime PM active state with\nonly the \"iis\" bus clock enabled, but it also sets priv->op_clk to the\nparent of the RCLK_SRC mux without enabling it. The runtime PM suspend\ncallback disables both clocks, so the first runtime suspend after probe\ndisables op_clk once more than it was enabled.\n\nOn Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate,\nso this triggers the following warning during boot:\n\n WARNING: drivers/clk/clk.c:1270 at clk_core_disable", "references": ["https://git.kernel.org/stable/c/2c64c30d493d82d5edc95811cede0083e1195822", "https://git.kernel.org/stable/c/5dac6bf09b5a4fff2433629801309c3884c3e94a", "https://git.kernel.org/stable/c/64bb35079dcbc67901da1fe8c52c234cbcd17df3"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99088", "noindex": false, "published": "2026-10-26T14:51:58.460Z", "modified": "2026-10-26T14:51:58.460Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99088", "title": "net: openvswitch: validate transport header presence in set_ipv6_addr", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key->ip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto.  Because skb->transport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although\nit is completely harmless.", "references": ["https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599", "https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da", "https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-98943", "noindex": false, "published": "2026-10-26T00:00:00Z", "modified": "2026-10-28T08:25:25.397603833Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98943", "title": "UBUNTU-CVE-2026-98943", "description": "In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock.", "references": ["https://ubuntu.com/security/CVE-2026-98943", "https://www.cve.org/CVERecord?id=CVE-2026-98943", "https://git.kernel.org/stable/c/6bce4b221dc0e144180c333123dbb82d1dc3a500"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99087", "noindex": false, "published": "2026-10-23T12:45:05.714Z", "modified": "2026-10-23T12:45:05.714Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99087", "title": "dm-integrity: fix NULL pointer dereference when the 'R' flag is used", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.", "references": ["https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f", "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956", "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99083", "noindex": false, "published": "2026-10-23T12:45:01.735Z", "modified": "2026-10-26T06:56:58.783Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99083", "title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneous", "references": ["https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99082", "noindex": false, "published": "2026-10-23T12:45:00.798Z", "modified": "2026-10-24T14:10:23.875Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99082", "title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information.  Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid.  When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, sup", "references": ["https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99081", "noindex": false, "published": "2026-10-23T12:23:28.347Z", "modified": "2026-10-24T14:10:22.790Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99081", "title": "bnxt_en: fix DMA mapping length for padded small packets", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a D", "references": ["https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268", "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99080", "noindex": false, "published": "2026-10-23T12:23:27.393Z", "modified": "2026-10-26T06:56:57.576Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99080", "title": "fs: Free any excess xarray nodes in clear_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes.  Hugh\ndocumented it well in commit 786b31121a2c.  Recently people and\nsyzbot have found ways to force it to happen with madvise.  Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "references": ["https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02", "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99077", "noindex": false, "published": "2026-10-23T12:23:22.773Z", "modified": "2026-10-26T15:13:01.358Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00374, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99077", "title": "ipv4: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless ", "references": ["https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592", "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a", "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99076", "noindex": false, "published": "2026-10-23T12:23:19.727Z", "modified": "2026-10-23T12:23:19.727Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99076", "title": "ipv6: udp: Create exceptions before socket matching", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less pr", "references": ["https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0", "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99076"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99067", "noindex": false, "published": "2026-10-23T12:23:10.430Z", "modified": "2026-10-23T12:23:10.430Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99067", "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.", "references": ["https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6", "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99063", "noindex": false, "published": "2026-10-23T12:23:04.655Z", "modified": "2026-10-23T12:23:04.655Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99063", "title": "dm ioctl: don't let data_start run past the buffer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n  Read o", "references": ["https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920", "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61", "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99061", "noindex": false, "published": "2026-10-23T12:22:59.770Z", "modified": "2026-10-23T12:22:59.770Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99061", "title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the ", "references": ["https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163", "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f", "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99058", "noindex": false, "published": "2026-10-23T12:22:45.920Z", "modified": "2026-10-23T12:22:45.920Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99058", "title": "workqueue: Fix NULL current_pwq deref in chained work check", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker->current_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker->current_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarni", "references": ["https://git.kernel.org/stable/c/3dc61af2998cfc7312d6e59bbdcd5eed074483f2", "https://git.kernel.org/stable/c/729d576df89c7e4341e58c452f8890620a610ac2", "https://git.kernel.org/stable/c/b12a25fb2b9d5dac80e419d695450cc17a51fdfd"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99057", "noindex": false, "published": "2026-10-23T12:22:44.683Z", "modified": "2026-10-23T12:22:44.683Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99057", "title": "xen/netfront: don't leak the skb when xennet_fill_frags() fails", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: don't leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb's frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path.  That path moves what's left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it's never\nfreed.  Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above ", "references": ["https://git.kernel.org/stable/c/5051df031144753d3e18862514969146b601d089", "https://git.kernel.org/stable/c/99011a11c97340ef7290df7dc199305c73fab2f2", "https://git.kernel.org/stable/c/086944c1c2cbb683543bc3ff08637847b03c8009"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99054", "noindex": false, "published": "2026-10-23T12:22:36.886Z", "modified": "2026-10-24T14:10:14.659Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99054", "title": "tipc: destroy topsrv workqueues before closing connections", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed w", "references": ["https://git.kernel.org/stable/c/7f796bb3b440d7f1b14c0e3b520462eb34f553af", "https://git.kernel.org/stable/c/da9c16568bc79140a54c1f5fcf07a0305df47b37", "https://git.kernel.org/stable/c/0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99053", "noindex": false, "published": "2026-10-23T12:22:35.462Z", "modified": "2026-10-24T14:10:13.569Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0017, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99053", "title": "tipc: hold a reference to nodes found by link name", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer.  Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n  CPU 0: find the node under RCU and release the node read lock\n  CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n  CPU 1: drop the list an", "references": ["https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110", "https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9", "https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}, {"id": "CVE-2026-99052", "noindex": false, "published": "2026-10-23T12:22:34.168Z", "modified": "2026-10-23T12:22:34.168Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99052", "title": "selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts\n\nWhen an NFSv4 filesystem exported with security_label is mounted a\nsecond time, sget_fc() returns the existing superblock and\nnfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the\nsuperblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an\nearly exit without setting SECURITY_LSM_NATIVE_LABELS in\n*set_kern_flags. nfs_get_root() then sees kflags without\nSECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on\nthe shared nfs_server, silently disabling per-file labeli", "references": ["https://git.kernel.org/stable/c/a545def625860d4ccedc14fe45e884a62a041cef", "https://git.kernel.org/stable/c/a6da93c625b3557dd23ff6db45d2d1bafeae1565", "https://git.kernel.org/stable/c/5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b"], "fixes": [], "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}]}], "total": 5461, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-kvm", "path": "vulns/ubuntu-pro-20.04-lts/linux-kvm", "ecosystem": "Ubuntu:Pro:20.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 430, "kev": 0}, "lastmod": "2026-10-28T08:25:25.397603833Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}