MontaVista CVE List and Response
MontaVista continually monitors the security community and customers for threats. We follow the community on CVE scoring (NVD) and set fix priority accordingly for affected products. Please view the following CVEs that have been remediated or are in process by clicking the CVE Year to the left or use the CVE Filters below.
For reporting Known Exploitable Vulnerabilities (KEV) or new Security Vulnerabilities, please see our Vulnerability Response Policy or email our PSIRT team. Messages and attachments should be encrypted using PGP and a MontaVista PSIRT PGP key, which is available for download here.
| CVE | Score | Severity | Package | Description | Published |
|---|---|---|---|---|---|
| CVE-2026-35328 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35329 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35330 |
8.1 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35331 |
4.8 (i)
| MEDIUM | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35332 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35333 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-35334 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-11-08 |
| CVE-2026-123158 |
8.1 (i)
| HIGH | openssh | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux. | 2026-11-05 |
| CVE-2026-99261 |
5.5 (i)
| MEDIUM | kernel | In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: correct reservation fence slots for userq per-vm BOs evictionIt fixes both the move overflow and the eviction fence add forevicting these per-vm BOs. | 2026-11-03 |
| CVE-2026-99258 |
5.5 (i)
| MEDIUM | kernel | In the Linux kernel, the following vulnerability has been resolved:x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()hv_apicid_to_vp_index() currently uses the per-cpu hypercall inputand output pages. This function is called when running in VTL2 andwhen running in an SEV-SNP CoCo VM with no paravisor. In the formercase, the output page is allocated, but in the latter case it isnot, so the hypervisor stores the output VP index in memory that hasnot been allocated by the guest.Fix this by using the input page for both input and output. Thehypercall has very small input and output, so sharing the samepage for both is straightforward. An alternative fix is toallocate the per-cpu output page when running in an SEV-SNP CoCoguest, but this uses significantly more memory, particularlywith larger vCPUs counts. | 2026-11-03 |