{"kind": "product", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "name": "linux-aws-5.3", "product": "linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2026-99216", "noindex": false, "published": "2026-10-28T10:36:09.383Z", "modified": "2026-10-28T10:36:09.383Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99216", "title": "Drivers: hv: Don't reset VMBus connection state on error/exit paths", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started ch", "references": ["https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5", "https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195", "https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99215", "noindex": false, "published": "2026-10-28T10:36:08.618Z", "modified": "2026-10-28T10:36:08.618Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99215", "title": "power: supply: core: prevent unregistering a power supply while a callback runs", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after ", "references": ["https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090", "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6", "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99214", "noindex": false, "published": "2026-10-28T10:36:07.867Z", "modified": "2026-10-28T10:36:07.867Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99214", "title": "drm/vc4: hdmi: Move packet RAM enable to PM runtime", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn't been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[  201.570266] ------------[ cut here ]------------\n[  201.570293] Packet RAM has", "references": ["https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27", "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2", "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99213", "noindex": false, "published": "2026-10-28T10:36:06.441Z", "modified": "2026-10-28T10:36:06.441Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99213", "title": "vsock: treat TCP_CLOSING as once-established", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_t", "references": ["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7", "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d", "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99212", "noindex": false, "published": "2026-10-28T10:36:05.612Z", "modified": "2026-10-28T10:36:05.612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99212", "title": "net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect", "references": ["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99211", "noindex": false, "published": "2026-10-28T10:36:04.864Z", "modified": "2026-10-28T10:36:04.864Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99211", "title": "netlink: reset skb headers before unicast and multicast filtering", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb's network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket's\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in ", "references": ["https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d", "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47", "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99210", "noindex": false, "published": "2026-10-28T10:36:04.110Z", "modified": "2026-10-28T10:36:04.110Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99210", "title": "accel/rocket: clear rdev on device init failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: clear rdev on device init failure\n\nrocket_probe() stores the return value from rocket_device_init() in the\nfile-scoped rdev pointer before checking whether it is an error pointer.\nIf rocket_device_init() fails, rdev is left as an ERR_PTR.\n\nThe rdev pointer is also used as the marker for whether the shared rocket\ndevice has already been initialized. A later core probe can therefore see\na non-NULL rdev, skip rocket_device_init(), and dereference the error\npointer when reading rdev->num_cores.\n\nSave the error code and clear rdev before returning from the\nrocket_de", "references": ["https://git.kernel.org/stable/c/79071b67182e1b352d51a3917729b8d424710b49", "https://git.kernel.org/stable/c/dd47a6c920083b069f00f0920e4566915a6aec46", "https://git.kernel.org/stable/c/4ac852419f0d317c7bd8db5b8acb3cc78be7fe33"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99209", "noindex": false, "published": "2026-10-28T10:36:03.274Z", "modified": "2026-10-28T10:36:03.274Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99209", "title": "drm/xe: skip eviction of a BO with no resource", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: skip eviction of a BO with no resource\n\nxe_evict_flags() switches on tbo->resource->mem_type to choose an\neviction placement. An xe BO can reach eviction with no ttm.resource,\ne.g. an imported dma-buf BO whose resource was freed during teardown\nwhile its attachment is still live: the exporter then invalidates it via\nxe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a\nNULL resource and faults.\n\nA BO with no resource has nothing placed or mapped, so there is nothing\nto evict. Return an empty placement (num_placement = 0), mirroring the\nhandling alr", "references": ["https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f", "https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8", "https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99208", "noindex": false, "published": "2026-10-28T10:36:01.473Z", "modified": "2026-10-28T10:36:01.473Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99208", "title": "drm/xe/oa: Zero OA buffer at allocation", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Zero OA buffer at allocation\n\nttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and\nmay contain data from previously freed pages. Since the OA buffer is\nmmap'able by userspace, this can expose stale kernel memory contents.\n\nStreams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA\nbuffer without calling xe_oa_init_oa_buffer(). Zero the buffer at\nallocation to prevent information disclosure through mmap.\n\nThe existing zeroing in xe_oa_init_oa_buffer() remains necessary for\nzero report-id/timestamp detection on enable/re-enable.\n\n(cherry ", "references": ["https://git.kernel.org/stable/c/21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9", "https://git.kernel.org/stable/c/cd3e2918c247db631d88cdd704596d9d27e5513e", "https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99207", "noindex": false, "published": "2026-10-28T10:36:00.728Z", "modified": "2026-10-28T10:36:00.728Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99207", "title": "scsi: target: Disable interrupts while holding delayed_cmd_lock", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Disable interrupts while holding delayed_cmd_lock\n\ntarget_do_delayed_work() takes dev->delayed_cmd_lock with a plain\nspin_lock(). It runs from system_percpu_wq, so interrupts stay enabled\nwhile the lock is held. Every other acquisition of that lock uses\nspin_lock_irqsave(): target_handle_task_attr() and\ntransport_complete_ordered_sync() in target_core_transport.c, and\ntarget_non_ordered_release() in target_core_device.c.\n\nThat was safe while every caller of transport_complete_task_attr() ran\nin process context: target_complete_ok_work() from target_completion_w", "references": ["https://git.kernel.org/stable/c/7563650522732041ccfb2e4593878b5ea98d498c", "https://git.kernel.org/stable/c/04a67a8b1a4460345d22fe75d93430cbf7e651d7", "https://nvd.nist.gov/vuln/detail/CVE-2026-99207"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99206", "noindex": false, "published": "2026-10-28T10:35:59.851Z", "modified": "2026-10-28T10:35:59.851Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99206", "title": "scsi: target: iscsi: Fix race in discovery auth updates", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.", "references": ["https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999", "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099", "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99205", "noindex": false, "published": "2026-10-28T10:35:59.093Z", "modified": "2026-10-28T10:35:59.093Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99205", "title": "sched/core: Call wakeup_preempt() for queued tasks during class change", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Call wakeup_preempt() for queued tasks during class change\n\nPaul reported recent RCU changes exposed a lost resched where CPU idles\nwith a rcutorture thread waiting while being completely runnable.\n\nDumping the rq state at the time of idling with runnable tasks showed\nthe following:\n\n  rq->next_class = &fair_sched_class\n  rq->nr_running = 1\n  rq->cfs.h_nr_queued = 0\n  rq->rt.rt_nr_running = 1\n\nAlthough the waiting task was an RT task, \"rq->next_class\" did not point\nto rt_sched_class and was stuck at the lower priority fair_sched_class.\n\nInspecting sched_change_en", "references": ["https://git.kernel.org/stable/c/ae89744c5ebf299bf55ac7581768fbd9f119a903", "https://git.kernel.org/stable/c/118a2cf4ced60777a2408001e2b4838fed1cea55", "https://nvd.nist.gov/vuln/detail/CVE-2026-99205"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99204", "noindex": false, "published": "2026-10-28T10:35:58.336Z", "modified": "2026-10-28T10:35:58.336Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99204", "title": "ocfs2/dlm: Protect the recovery list during debugfs reads", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock,", "references": ["https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537", "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284", "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99203", "noindex": false, "published": "2026-10-28T10:35:57.589Z", "modified": "2026-10-28T10:35:57.589Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99203", "title": "pipe: preserve existing fasync readers on writer setup failure", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), s", "references": ["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa", "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521", "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99202", "noindex": false, "published": "2026-10-28T10:35:56.827Z", "modified": "2026-10-28T10:35:56.827Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99202", "title": "scsi: libsas: Fix SMP IO deadlock during HA resume", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()\n-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset f", "references": ["https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c", "https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85", "https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99201", "noindex": false, "published": "2026-10-28T10:35:56.069Z", "modified": "2026-10-28T10:35:56.069Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0016, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99201", "title": "netlink: avoid hashing the network namespace pointer", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table's bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace's unique, non-address net_cookie in the comparison\nkey ", "references": ["https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b", "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28", "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99200", "noindex": false, "published": "2026-10-28T10:35:55.323Z", "modified": "2026-10-28T10:35:55.323Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99200", "title": "net: hisilicon: hisi_femac: Move setting of netops to fix crash", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: hisi_femac: Move setting of netops to fix crash\n\nhisi_femac_drv_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\n  phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c\n  of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558\n  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nAssign netdev_ops before th", "references": ["https://git.kernel.org/stable/c/06ef5b084b150c538bc84148e5d710eee012413c", "https://git.kernel.org/stable/c/444889dfa27b54b39026e962464b1f8f9093e1ea", "https://nvd.nist.gov/vuln/detail/CVE-2026-99200"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99199", "noindex": false, "published": "2026-10-28T10:35:54.538Z", "modified": "2026-10-28T10:35:54.538Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99199", "title": "net: hisilicon: hip04_eth: Move setting of netops to fix crash", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: hip04_eth: Move setting of netops to fix crash\n\nhip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").", "references": ["https://git.kernel.org/stable/c/1c2f9c3a63baabfb965a23a00f026f3ddcaadb24", "https://git.kernel.org/stable/c/0d9342701f14ec0a9465772b7cd5d515c1ecd818", "https://nvd.nist.gov/vuln/detail/CVE-2026-99199"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99198", "noindex": false, "published": "2026-10-28T10:35:53.740Z", "modified": "2026-10-28T10:35:53.740Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00177, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99198", "title": "net: ethernet: actions: Move setting of netops to fix crash", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: actions: Move setting of netops to fix crash\n\nowl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,\nbefore netdev->netdev_ops is assigned. phy_attach_direct() ->\nphy_link_topo_add_phy() reads dev->netdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").", "references": ["https://git.kernel.org/stable/c/d2eca3a54f415081711cd102d0db733de5abf170", "https://git.kernel.org/stable/c/c2c4824319850c87e77d26aeb8f860bc310a64d7", "https://nvd.nist.gov/vuln/detail/CVE-2026-99198"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-99197", "noindex": false, "published": "2026-10-28T10:35:52.987Z", "modified": "2026-10-28T10:35:52.987Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99197", "title": "net: mv643xx: move setting of netops to fix crash", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mv643xx: move setting of netops to fix crash\n\nmv643xx_eth_probe() connects the PHY before dev->netdev_ops is\nassigned. phy_attach_direct() -> phy_link_topo_add_phy() reads\ndev->netdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").", "references": ["https://git.kernel.org/stable/c/bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9", "https://git.kernel.org/stable/c/a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a", "https://nvd.nist.gov/vuln/detail/CVE-2026-99197"], "fixes": [], "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 19600, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux-aws-5.3", "path": "vulns/ubuntu-18.04-lts/linux-aws-5.3", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1055, "kev": 0}, "lastmod": "2026-10-28T10:36:09.383Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}