CVE-2026-64551Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk->skb->data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause…
CVE-2026-64548Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy…
CVE-2026-64547Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the…
CVE-2026-64546Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-64545Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an…
CVE-2026-64543Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-64541Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in…
CVE-2026-64540Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header…
CVE-2026-64539Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Ubuntu Linux…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only…
CVE-2026-64532Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the…
CVE-2026-64531Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…27. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An…
CVE-2026-64530Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…26. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if…
CVE-2026-64529Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the…
CVE-2026-64524Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-64523Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file…
CVE-2026-64522Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs…
CVE-2026-64515Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE) is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original elements. This is incorrect for two reasons: - if the original defragmentation was needed, it will not find the correct data - if the original frame is at a higher address, the…
CVE-2026-64511Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If…
CVE-2026-64509Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc > into build(), the leaked queue can retain blk-mq state after the tag set is dropped. Fix the pre-registration failure path by…
CVE-2026-64508Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors…
CVE-2026-64507Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64506Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence number, and leads to unexpected packet drop. It is more likely to encounter this failure when there are busy traffic during rekey process and could lead to disconnection from the…
CVE-2026-64505Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64504Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it…
CVE-2026-64496Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller. The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace. But since fd…
CVE-2026-64490Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A…
CVE-2026-64487Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64485Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd_compr_task_new() allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task wrapper and DMA-buffer references without calling the driver's task_free() callback. Any driver resources allocated by task_create() are therefore leaked. The dual-fd allocation…
CVE-2026-64481Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work. Those controls are not removed on component unbind, and device remove only cancels fw_load_work through cs35l41_remove_dsp(). That helper is skipped when halo_initialized is false. With firmware_autostart disabled, a…
CVE-2026-64478Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…