CVE-2026-43351 KVM: arm64: Eagerly init vgic dist/redist on vgic creation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgicallocateprivateirqslocked fails for any odd reason, we exit kvmvgiccreate early, leaving dist-rdregions uninitialised. kvmvgicdistdestroy then comes along and walk...

CVE-2026-43347

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

CVE-2026-43347 arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

SUSE CVE-2026-43150

In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models at least with a warning, and unknown revisions of those which we do know, as although things do...

Oracle Linux 9 : libpng (ELSA-2026-14791)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-14791 advisory. 2:1.6.37-12.3 - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon RHEL-161291 Tenable has extracted the preceding description block...

USN-8251-1: libpng vulnerabilities

It was discovered that libpng incorrectly handled memory when processing certain PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service, or possibly execute...

USN-8251-1 libpng1.6 vulnerabilities

It was discovered that libpng incorrectly handled memory when processing certain PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service, or possibly execute...

libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion

A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to...

APEI/GHES: ARM processor Error: don't go past allocated memory

...

SUSE CVE-2026-43266

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the sectionlength is too small, but it doesn't detect if it is too big. Currently, if the firmware receives an ARM process...

Oracle Linux 10 : libpng (ELSA-2026-14790)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-14790 advisory. 2:1.6.40-8.3 - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon RHEL-161208 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-43150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models at least with a warning, and unkno...

libpng security update

2:1.6.37-12.3 - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon RHEL-161291...

libpng security update

2:1.6.40-8.3 - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon RHEL-161208...

CVE-2026-43266

A flaw was found in the Linux kernel's handling of Common Platform Error Records CPER for ARM processors. This vulnerability allows a local attacker or malicious firmware to provide a malformed CPER record with an excessively large section length. The kernel then attempts to read data beyond the...

CVE-2026-43201

A flaw was found in the Linux kernel's Advanced Processor Error Interface APEI / Generic Hardware Error Source GHES handling. If the BIOS generates a very small or incomplete ARM Processor Error record, the kernel's error handling logic can attempt to access memory beyond allocated bounds. This...

libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion

A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to...

EUVD-2026-27665

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the sectionlength is too small, but it doesn't detect if it is too big. Currently, if the firmware receives an ARM process...

EUVD-2026-27760

In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don't go past allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err-sectionlength and ctxinfo-size Add checks ...

EUVD-2026-27709

In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models at least with a warning, and unknown revisions of those which we do know, as although things do...