EUVD-2026-59080

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

Microweber <1.2.12 - Integer Overflow

Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request. id: CVE-2022-0968 info: name: Microweber 1.2.12 - Integer...

MINI-7P8J-CXXJ-MMC8

Bulletin has no description...

PT-2026-72222

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill from part fill from part computes the size of a directory entry in size t but stores it in a u32. An entry length near U32 MAX wraps it to a small value, bypasses the bounds...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

PT-2026-72797

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdp idx when it equals n i.e. NUMFDPC + 1...

PT-2026-72830

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm buf-len is a user-controlled uint32 t received from the network. Adding it to imm data offset without overflow checking allows a malicious initiator to send...

PT-2026-72853

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon align pitch radeon align pitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed...

PT-2026-72257

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in update rlimit cpu update rlimit cpu converts the RLIMIT CPU value to nanoseconds with u64 nsecs = rlim new NSEC PER SEC; On 32-bit kernels both rlim new unsigned long and NSEC PER SEC...

PT-2026-72294

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset size overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to region count overflow" made sure that region count could fit in an unsigned int. But the bitmap memory isn't allocat...

PT-2026-72486

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr endpoint post qrtr endpoint post validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, size t is 32 bits and...

PT-2026-72890

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...

PT-2026-73022

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs rl realloc and ntfs rl realloc nofail...

CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

PT-2026-73021

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: widen NAT rewrite delta to s32 in sip help tcp sip help tcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more...

PT-2026-72555

In the Linux kernel, the following vulnerability has been resolved: iomap: guard io size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io size tracks only valid data within EOF. This trims io size whe...

PT-2026-72557

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minix check superblock uses minix blocks needed to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...