The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
* kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
* kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
* kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
* kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
* kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
* kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
* kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
* kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
* kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
* kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
* kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
* kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
* kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
* kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
* kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
* kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Gitingest versions up to 0.3.1 contain a vulnerability where unauthenticated attackers can exploit symlink following in the ingest_query single-file blob ingestion feature. This allows attackers to read server files accessible to the service user by submitting symlink blob URLs, potentially exposing sensitive data up to 10 MB in size.
CVE-2026-86566 is an integer underflow vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It occurs when a guest with runt RX descriptors causes an underflow in the copy length during vhost enqueue operations. This flaw can lead to a denial of service in shared vhost backends such as OVS-DPDK. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-33798 is a high-severity stack-based buffer overflow vulnerability in the srxpfe component of Juniper Networks Junos OS and Junos OS Evolved on SRX Series devices. It allows an L2-adjacent attacker to execute arbitrary code with root privileges via high-availability fabric traffic. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. No known exploits are reported in the wild. The CVSS v3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-33792 is a critical stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute code as root or cause a denial of service by sending a crafted packet on a configured GRE tunnel. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
CVE-2026-102174 is a stack-based buffer overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series. It allows an authenticated remote-access VPN client to execute code with root privileges or cause a denial of service. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 8.8, indicating high severity.
CVE-2026-102059 is an OS command injection vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX, SRX, and QFX Series devices. An adjacent unauthenticated attacker can exploit this flaw by using a rogue DHCP server to execute arbitrary commands with root privileges. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. It has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. The vendor has not provided explicit patch links in the provided data, so patch status should be verified with Juniper advisories.
CVE-2026-102048 is a resource allocation vulnerability in the l2cpd process of Juniper Networks Junos OS. It allows an adjacent unauthenticated attacker to cause denial of service and restart of the l2cpd process via FNP-enabled Layer 2 interfaces. The issue occurs when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation. All Junos OS platforms except PTX and SRX Series are affected.
CVE-2026-102037 is a high-severity XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute arbitrary device configuration commands with root privileges by exploiting a malicious response from a configured custom URL-feed server. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.1, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-75083 is an integer overflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver within the Zephyr project. It occurs in the kw41z_rx() function where the payload size is computed incorrectly, leading to an underflow and subsequent buffer overflow in the network buffer pool. This can cause memory corruption and likely crashes due to overwriting adjacent memory. The vulnerability is triggered by unauthenticated frames with a crafted length field sent over the air. The issue affects Zephyr versions from 1.8.0 up to but not including 4.5.0.
CVE-2026-101938 is an integer underflow vulnerability in the srxpfe component of Juniper Networks Junos OS and Junos OS Evolved on SRX Series devices. This flaw allows an adjacent unauthenticated attacker to cause a denial of service on the forwarding plane by sending a crafted ICMP message related to an SVR carrier session. The vulnerability has a medium severity with a CVSS score of 6.5 and does not impact confidentiality or integrity but affects availability.
CVE-2026-101937 is a medium severity vulnerability in Juniper Networks Junos OS affecting the SRX Series. It involves a signed to unsigned conversion error in the srxpfe component, which allows an adjacent attacker to cause a denial of service (DoS) of the data plane via chassis-cluster fabric traffic. No confidentiality or integrity impact is reported. The vulnerability affects multiple specific Junos OS versions prior to certain patch releases.
CVE-2026-101936 is a reachable assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series devices. It allows an adjacent network attacker to cause a denial of service (DoS) of the data plane by sending malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. No confidentiality or integrity impact is reported, only availability is affected. Multiple versions of Junos OS prior to specific patch releases are affected.
CVE-2026-101950 is a critical heap-based buffer overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series devices. An unauthenticated network attacker can exploit this vulnerability by sending malformed IPv4 packets to an interface configured for Secure Vector Routing, potentially causing denial of service and compromising confidentiality and integrity.
CVE-2026-101955 is a high-severity stack-based buffer overflow vulnerability in the UTM Anti-Spam SBL feature of Juniper Networks Junos OS on SRX series devices. It allows an unauthenticated remote attacker to cause arbitrary code execution or denial of service by sending a malformed DNS packet when Anti-Spam SBL inspection is enabled.
CVE-2026-101997 is a high-severity SQL Injection vulnerability in the ipfd component of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute code with root privileges via a configured Security Intelligence feed connection. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.1, indicating a significant risk of confidentiality, integrity, and availability impact.
CVE-2026-102062 is a high-severity vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series devices. It involves an externally-controlled format string flaw that allows an unauthenticated network attacker to execute code with root privileges by exploiting a compromised or impersonated HTTPS feed server configuration. The vulnerability affects multiple Junos OS versions prior to specific fixed releases. The CVSS score is 8.1, indicating a significant risk. No known exploits are reported in the wild at this time.
CVE-2026-102078 is a Use After Free vulnerability in the packet forwarding engine of Juniper Networks Junos OS on SRX Series devices. It can be triggered by an unauthenticated, network-based attacker when web filtering for TCP traffic is enabled and a high volume of DNS requests occurs. This causes a race condition that leads to a flowd process crash and restart, resulting in a temporary Denial-of-Service (DoS) until automatic recovery. The vulnerability affects multiple Junos OS versions prior to specific fixed releases. A patch is available to address this issue.
CVE-2026-102081 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX and MX Series devices. It involves a memory leak in the packet forwarding engine (PFE) when certain application services are configured and a high connection churn occurs. This can lead to exhaustion of PFE memory and cause a complete denial-of-service (DoS). The issue affects specific Junos OS versions from 23.4R2-S3 up to but not including 23.4R2-S7, 24.2R2 up to but not including 24.2R2-S3, 24.4 up to but not including 24.4R2-S3, and version 25.2. A patch is available to address this vulnerability.