CVE-2026-64505Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64504Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it…
CVE-2026-64496Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller. The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace. But since fd…
CVE-2026-64490Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A…
CVE-2026-64487Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64485Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd_compr_task_new() allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task wrapper and DMA-buffer references without calling the driver's task_free() callback. Any driver resources allocated by task_create() are therefore leaked. The dual-fd allocation…
CVE-2026-64481Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work. Those controls are not removed on component unbind, and device remove only cancels fw_load_work through cs35l41_remove_dsp(). That helper is skipped when halo_initialized is false. With firmware_autostart disabled, a…
CVE-2026-64478Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64476Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64475Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could…
CVE-2026-64473Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits…
CVE-2026-64472Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach…
CVE-2026-64469Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired. This means that transaction…
CVE-2026-64468Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-64467Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry read. On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels it walks the 8-byte entries in 4-byte steps, iterating an N-entry array 2N times, and reads the…
CVE-2026-64466Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone…
CVE-2026-64465Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64464Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after…
CVE-2026-64463Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback. Register a devres action immediately after tcpci_register_port()…
CVE-2026-64461Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set up earlier by mtk_pcie_init_irq_domain() are never freed. Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when…
CVE-2026-64460Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both…
CVE-2026-64458Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem. When the user sets the aggregation interval…
CVE-2026-64457Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: vp_del_vqs+0x121/0x230 remove_common+0x135/0x150…
CVE-2026-64456Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64). A malicious or…
CVE-2026-64455Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64454Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-16232Multi-Domain Security Management22. Jul 2026
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check…
CVE-2026-63984F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-63983F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared…
CVE-2026-63982F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop When mirred redirects to ingress (from either ingress or egress) the loop state from sched_mirred_dev array dev is lost because of 1) the packet deferral into the backlog and 2) the fact the sched_mirred_dev array is cleared. In such cases, if there was a loop we won't discover it. Here's a simple test to reproduce: ip a add dev port0…