A vulnerability in the Linux kernel's drm/vc4 driver was fixed by disabling the V3D interrupt across runtime suspend. The issue involved spurious interrupts occurring after the power domain was turned off, causing the interrupt handler to run when hardware registers returned invalid data. This could lead to scheduling of overflow memory work incorrectly. The fix ensures the interrupt line is disabled during power management transitions to prevent these spurious interrupts.
A vulnerability in the Linux kernel USB hub driver causes an AMD platform issue due to holding a USB3 hub power management runtime reference for 200ms during hub resume. This can lead to crashes on affected systems, notably reported by Android adb users. The issue is mitigated by reducing the hold time to 120ms for USB3 root hubs, which is both a fix and an optimization. External hubs retain the 200ms hold time. Multiple Linux kernel versions are affected and have been fixed in subsequent releases.
CVE-2026-98927 is a high-severity vulnerability in the Linux kernel's KVM arm64 nested virtualization implementation. It involves improper management of the nested_mmus array lifecycle, which holds shadow page tables for nested guests. The flaw could lead to use-after-free conditions when a VCPU_INIT triggers relocation of this array while a vCPU is running a nested context. The issue is fixed by changing the nested_mmus array to an array of pointers allocated at VM creation, eliminating reallocations and clarifying object lifecycles. The fix is included in Linux kernel version 6.11.
A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) related to Display Power Management Signaling (DPMS) has been fixed. The issue involved improper handling of the optional stream->sink pointer, which could be null and was dereferenced without checking. The fix replaces usage of stream->sink->link with stream->link, adds assertions for USB4 bandwidth allocation, and improves resource access consistency.
CVE-2026-98918 is a vulnerability in the Linux kernel's memory management subsystem (DAMON) where an unaligned address passed to a page table walk function can cause out-of-bounds writes. This occurs on arm64 architectures after a code change altered how page table entries are walked, potentially leading to writes beyond the intended page table page. The issue can cause kernel crashes or silent memory corruption depending on the memory protection of the adjacent page. The fix involves ensuring a page-aligned address is used in the vulnerable function.
CVE-2026-98911 is a high-severity vulnerability in the Linux kernel's dpaa2-switch component. It involves an incorrect error handling path in the dpaa2_switch_rx() function, where the wrong function is called to free frame descriptors, potentially leading to improper memory management. The issue is fixed by adjusting the error handling to correctly unmap DMA pages and free memory depending on whether an SKB was created.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was fixed. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources during flower setup failures, which could lead to resource leaks. Specifically, if an error occurred after allocating stream gate, flow meter, and stream filter resources but before completing setup, these resources were not properly released. Additionally, a logic error in handling flow meter IDs could cause incorrect deletion attempts, leaving reference counts improperly incremented.
A vulnerability in the Linux kernel's imx mailbox driver was addressed by changing the power management runtime enablement sequence. The issue involved early usage of the device before probe completion, which could cause improper device removal and shutdown sequences. The fix delays pm_runtime_enable() to the removal path and adjusts the order of mailbox controller registration and power management handling to ensure correct device lifecycle management.
A vulnerability in the Linux kernel's AMD GPU driver (drm/amd/pm/si) was fixed to prevent scheduling thermal work when the thermal work queue is not initialized. This issue occurs when Dynamic Power Management (DPM) is disabled using the amdgpu.dpm=0 module parameter, which leaves the thermal work queue uninitialized. Scheduling work on an uninitialized queue could lead to kernel instability or crashes.
Atlassian's October 2026 security bulletin addresses 75 unique vulnerabilities affecting its Data Center and Server products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. Among these, 14 are critical-severity issues primarily in third-party components such as Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. Atlassian assesses the risk from these third-party component vulnerabilities as lower and non-critical for their products. The bulletin includes a variety of issues such as denial-of-service, cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure, and code execution bugs. Atlassian recommends updating to the latest product versions or fixed releases to mitigate these vulnerabilities. There is no indication of active exploitation in the wild for these issues.
CVE-2026-63244 is a critical authentication bypass vulnerability in WizLearn Technologies' Learning Management System. It allows an unauthenticated remote attacker to bypass both password and OAuth authentication by sending a specially crafted POST request. Successful exploitation could lead to unauthorized access to user accounts and full administrative control of the LMS platform.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
A privilege management vulnerability in the User Profile Builder WordPress plugin before version 4.0.5 allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form. This includes the ability to change a Network Super Admin's email and potentially take over that account through the password-reset process.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.