{"kind": "product", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "name": "linux-aws-fips", "product": "linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS", "items": [{"id": "CVE-2026-99216", "noindex": false, "published": "2026-10-28T10:36:09.383Z", "modified": "2026-10-28T10:36:09.383Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99216", "title": "Drivers: hv: Don't reset VMBus connection state on error/exit paths", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started ch", "references": ["https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5", "https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195", "https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99215", "noindex": false, "published": "2026-10-28T10:36:08.618Z", "modified": "2026-10-28T10:36:08.618Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99215", "title": "power: supply: core: prevent unregistering a power supply while a callback runs", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after ", "references": ["https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090", "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6", "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99213", "noindex": false, "published": "2026-10-28T10:36:06.441Z", "modified": "2026-10-28T10:36:06.441Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99213", "title": "vsock: treat TCP_CLOSING as once-established", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_t", "references": ["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7", "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d", "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99212", "noindex": false, "published": "2026-10-28T10:36:05.612Z", "modified": "2026-10-28T10:36:05.612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99212", "title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect", "references": ["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99211", "noindex": false, "published": "2026-10-28T10:36:04.864Z", "modified": "2026-10-28T10:36:04.864Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99211", "title": "netlink: reset skb headers before unicast and multicast filtering", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb's network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket's\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in ", "references": ["https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d", "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47", "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99209", "noindex": false, "published": "2026-10-28T10:36:03.274Z", "modified": "2026-10-28T10:36:03.274Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99209", "title": "drm/xe: skip eviction of a BO with no resource", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: skip eviction of a BO with no resource\n\nxe_evict_flags() switches on tbo->resource->mem_type to choose an\neviction placement. An xe BO can reach eviction with no ttm.resource,\ne.g. an imported dma-buf BO whose resource was freed during teardown\nwhile its attachment is still live: the exporter then invalidates it via\nxe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a\nNULL resource and faults.\n\nA BO with no resource has nothing placed or mapped, so there is nothing\nto evict. Return an empty placement (num_placement = 0), mirroring the\nhandling alr", "references": ["https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f", "https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8", "https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99206", "noindex": false, "published": "2026-10-28T10:35:59.851Z", "modified": "2026-10-28T10:35:59.851Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99206", "title": "scsi: target: iscsi: Fix race in discovery auth updates", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.", "references": ["https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999", "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099", "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99204", "noindex": false, "published": "2026-10-28T10:35:58.336Z", "modified": "2026-10-28T10:35:58.336Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99204", "title": "ocfs2/dlm: Protect the recovery list during debugfs reads", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock,", "references": ["https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537", "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284", "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99203", "noindex": false, "published": "2026-10-28T10:35:57.589Z", "modified": "2026-10-28T10:35:57.589Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99203", "title": "pipe: preserve existing fasync readers on writer setup failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), s", "references": ["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa", "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521", "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99202", "noindex": false, "published": "2026-10-28T10:35:56.827Z", "modified": "2026-10-28T10:35:56.827Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99202", "title": "scsi: libsas: Fix SMP IO deadlock during HA resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()\n-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset f", "references": ["https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c", "https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85", "https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99201", "noindex": false, "published": "2026-10-28T10:35:56.069Z", "modified": "2026-10-28T10:35:56.069Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99201", "title": "netlink: avoid hashing the network namespace pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey ", "references": ["https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99192", "noindex": false, "published": "2026-10-28T10:35:48.686Z", "modified": "2026-10-28T10:35:48.686Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99192", "title": "net: bcmgenet: unshare the skb before writing the control block", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the dri", "references": ["https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac", "https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672", "https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99191", "noindex": false, "published": "2026-10-28T10:35:47.854Z", "modified": "2026-10-28T10:35:47.854Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99191", "title": "calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr->payload_len);\n\tip6_hdr->payload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb->len.  For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer ", "references": ["https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513", "https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656", "https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99189", "noindex": false, "published": "2026-10-28T10:35:46.366Z", "modified": "2026-10-28T10:35:46.366Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99189", "title": "gpio: mxc: fix race between chained IRQ handler install and probe completion", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n   port->domain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n   been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_", "references": ["https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68", "https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82", "https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99187", "noindex": false, "published": "2026-10-28T10:35:44.813Z", "modified": "2026-10-28T10:35:44.813Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99187", "title": "perf: Fix perf_pmu_migrate_context() leaving events behind", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pmu_migrate_context() leaving events behind\n\n__perf_pmu_remove() walks the group leaders of a CPU and PMU with\nperf_event_groups_for_cpu_pmu(), removing each one as it goes.\nperf_remove_from_context() takes the leader out of the groups rbtree,\nafter which rb_next() on that node returns NULL, prematurely ending the\nwalk. Other groups stay behind in the source context.\n\nOn CPU hotplug, they are then torn down with the dying CPU. They keep\nrunning until teardown, while the PMU's interrupt and migrated events\nare on a new CPU, which drivers rely on never happening", "references": ["https://git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef", "https://git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446", "https://git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99182", "noindex": false, "published": "2026-10-28T10:35:35.193Z", "modified": "2026-10-28T10:35:35.193Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99182", "title": "ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\n\n  UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n  shift exponent 18446744069414584384 is too large for 64-bit type 'long unsi", "references": ["https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0", "https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b", "https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99181", "noindex": false, "published": "2026-10-28T10:35:34.443Z", "modified": "2026-10-28T10:35:34.443Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99181", "title": "autofs: ignore notification errors from a replaced pipe", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: ignore notification errors from a replaced pipe\n\nautofs_notify_daemon() takes a reference to the current notification\npipe under wq_mutex, then drops the mutex before writing the request. The\nwrite can block while the daemon enters catatonic mode and installs a\nreplacement pipe.\n\nIf the old pipe's reader is then closed, the delayed write returns -EPIPE\nand the generic error path enters catatonic mode again. That transition\nacts on the current superblock state, closes the replacement pipe, and\nreleases the new daemon generation's wait queues.\n\nOnly enter catatonic mod", "references": ["https://git.kernel.org/stable/c/1a177064f501ed4b67873a43aae5d5bdb18b3704", "https://git.kernel.org/stable/c/fb296391f685d82dbb93621a970fb234cea45280", "https://git.kernel.org/stable/c/65676cd4203c0e41a94caf54080a7f0a95434bda"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99180", "noindex": false, "published": "2026-10-28T10:35:33.578Z", "modified": "2026-10-28T10:35:33.578Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99180", "title": "unicode: free the map after a grace period", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nunicode: free the map after a grace period\n\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from ->put_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\n\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\n\n  BUG: KASAN: slab-us", "references": ["https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8", "https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715", "https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99179", "noindex": false, "published": "2026-10-28T10:35:32.734Z", "modified": "2026-10-28T10:35:32.734Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99179", "title": "watch_queue: Fix note pool publication race in watch_queue_set_size()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix note pool publication race in watch_queue_set_size()\n\nThere is a race between watch_queue_set_size() and post_one_notification().\nwatch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and\nnr_notes with plain stores, and post_one_notification() reads them with\nplain loads under a different lock, so nothing orders the four stores\nagainst the poster's loads: depending on the build, notes can be stored\nlast (gcc 14 on x86-64 does this).  Since keyctl_watch_key() lets a watch\nattach to a queue before it is sized, post_one_notification() can alrea", "references": ["https://git.kernel.org/stable/c/811fb6d0b07605e8e8d93bde8748be4b3028809a", "https://git.kernel.org/stable/c/9e73a6754457ffed8399b835552013b9363e51d1", "https://git.kernel.org/stable/c/5e531d62f1f8834faf7a4eed0d41105cf6570a8f"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}, {"id": "CVE-2026-99178", "noindex": false, "published": "2026-10-28T10:35:31.961Z", "modified": "2026-10-28T10:35:31.961Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99178", "title": "x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context\n\nAn async #PF \"page not present\" event arrives through the #PF vector,\nand its reason sits in the per-CPU apf_reason.flags until\n__kvm_handle_async_pf() reads and clears it. If an NMI arrives after\nthe event is injected and before the #PF handler reads the flags, and\nthe NMI handler itself takes a #PF, that fault reads and clears the\nflags belonging to the #PF it interrupted. It then finds interrupts\ndisabled in the NMI context it interrupted, and panics:\n\n  Kernel panic - not syncing: Host injected async ", "references": ["https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921", "https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9", "https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"], "fixes": [], "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}]}], "total": 7622, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-aws-fips", "path": "vulns/ubuntu-pro-fips-updates-24.04-lts/linux-aws-fips", "ecosystem": "Ubuntu:Pro:FIPS-updates:24.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 759, "kev": 0}, "lastmod": "2026-10-28T10:36:09.383Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}