gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CVE-2026-93119

A flaw was found in the kernel. Specifically, within the USB LJCA driver's ljcaenumerategpio function, an attacker with a specially crafted malicious LJCA device could provide an unbounded banknum value. This improper handling of input leads to a stack overflow, which could result in a denial of...

CVE-2026-90417

A flaw was found in the Linux kernel's RDMA/cxgb4 component. When the device enters a fatal error state or experiences an allocation failure within the writetptentry function, it can lead to a memory leak and a double free vulnerability. A local attacker could potentially exploit this issue to...

CVE-2026-93163

A flaw was found in the hwrng core component of the Linux kernel. When the hwrngregister function fails during the registration process, it does not properly remove the hardware random number generator RNG from the global list. This oversight creates a dangling reference, which can lead to a...

CVE-2026-93134

A flaw was found in the Linux kernel. When the printk function handles legacy console printing, a specific scenario involving context handover can lead to a use-after-free vulnerability. This occurs because the system fails to verify if a memory area has been freed after a handover, potentially...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

gvfs: SFTP: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CVE-2026-93104

A flaw was found in the Linux kernel RDMA/rvt component. The rvtallocdevice function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issu...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-93079

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlgetfeature function does not properly validate the size of the output buffer against a user-controlled count value. This oversight allows a local attacker to provide a count larger than the allocated buffe...

CVE-2026-93060

A flaw was found in the Linux kernel's Adreno GPU driver. This use-after-free vulnerability occurs in the a6xxgpuinit function. Specifically, the a6xxdestroy function frees the a6xxgpu memory, but adrenogpu continues to point to the freed memory. An attacker could potentially exploit this to caus...

CVE-2026-98490

A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially...

RLSA-2026:84591 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

RLSA-2026:85191 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

RLSA-2026:84799 Important: mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

emacs security update

An update is available for emacs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNU Emacs is a powerful, customizable, self-documenting text editor. It provid...

xorg-x11-server-Xwayland security update

An update is available for xorg-x11-server-Xwayland. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Xwayland is an X server for running X clients under Wayland...