CVE-2026-64476Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64475Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could…
CVE-2026-64473Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits…
CVE-2026-64472Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach…
CVE-2026-64469Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired. This means that transaction…
CVE-2026-64468Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-64467Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry read. On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels it walks the 8-byte entries in 4-byte steps, iterating an N-entry array 2N times, and reads the…
CVE-2026-64466Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone…
CVE-2026-64465Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64464Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after…
CVE-2026-64463Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback. Register a devres action immediately after tcpci_register_port()…
CVE-2026-64461Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set up earlier by mtk_pcie_init_irq_domain() are never freed. Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when…
CVE-2026-64460Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both…
CVE-2026-64458Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem. When the user sets the aggregation interval…
CVE-2026-64457Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: vp_del_vqs+0x121/0x230 remove_common+0x135/0x150…
CVE-2026-64456Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64). A malicious or…
CVE-2026-64455Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-64454Debian Linux, Amazon Linux 2, Nutanix AOS, Red Hat Enterprise Linux, IBM QRadar SIEM, Red Hat OpenShift, Nutanix Prism…25. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…
CVE-2026-63984F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-63983F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared…
CVE-2026-63982F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop When mirred redirects to ingress (from either ingress or egress) the loop state from sched_mirred_dev array dev is lost because of 1) the packet deferral into the backlog and 2) the fact the sched_mirred_dev array is cleared. In such cases, if there was a loop we won't discover it. Here's a simple test to reproduce: ip a add dev port0…
CVE-2026-63981F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow tcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4) to prevent deep recursion. However, when the action uses blockcast (tcfm_blockid != 0), the function returns at the tcf_blockcast() call BEFORE reaching the counter increment. As a result, the recursion counter never advances and the limit check is entirely…
CVE-2026-63980F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU holds hn->hn_lock when a softirq invokes the cancel path, the lock attempt deadlocks…
CVE-2026-63979F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync()…
CVE-2026-63891F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line…
CVE-2026-63890F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiring dlen >= sizeof(struct fip_desc) in the default branch. The named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor…
CVE-2026-63883F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the…
CVE-2026-63837F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output ena_phc_gettimex64() is setting the output parameter regardless of whether ena_com_phc_get_timestamp() succeeded or failed. When ena_com_phc_get_timestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via…
CVE-2026-63836F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd The cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics. ((mss * 8) ** 2) / (cwnd * 8) In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around and be 0 - resulting in: ((mss * 8) ** 2) / 0 This…
CVE-2026-63835F5 F5OS, Dell NetWorker, Debian Linux, Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, Dell Avamar, RESF…19. Jul 2026
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…