https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:59:45.500491+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bell-cve-2026-93795 BELL-CVE-2026-93795 2026-09-28T15:59:45.940765+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93795 fkie_cve-2026-93795 2026-09-28T15:59:45.940892+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix leaks and online flag on radix_tree_insert failure

When radix_tree_insert() fails in blkg_create(), the error path has two issues:

1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block.

2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed.

Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().

 https://vulnerability.circl.lu/vuln/ghsa-q3xm-frv6-mwqx GHSA-q3xm-frv6-mwqx 2026-09-28T15:59:45.940977+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix leaks and online flag on radix_tree_insert failure

When radix_tree_insert() fails in blkg_create(), the error path has two issues:

1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block.

2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed.

Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93795 UBUNTU-CVE-2026-93795 2026-09-28T15:59:45.941025+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radix_tree_insert failure When radix_tree_insert() fails in blkg_create(), the error path has two issues: 1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block. 2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed. Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().

 https://vulnerability.circl.lu/vuln/wid-sec-w-2026-3579 WID-SEC-W-2026-3579 — Linux Kernel: Mehrere Schwachstellen 2026-09-28T15:59:45.941694+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen oder nicht näher spezifizierten Angriff durchzuführen.