EUVD-2026-59110

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing arrayindexnospec call to prevent speculative execution...

PT-2026-72918

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/zcrypt component where a user-controlled domain value is extracted from a CCA or EP11 ioctl struct during the preparation of a CPRB. Under specific conditions...

PT-2026-72845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtw89 wifi driver where the mac id field in RX descriptors, which is 8 bits wide 0-255, is used as an array index for assoc link on macid without validation. Since...

PT-2026-72424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hw perf event init function where the ev variable, which is controlled by userspace via event-attr.config, is used as an array index. Although bounds checking is...

PT-2026-72615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the replace effective prog and purge effective progs functions incorrectly locate slots in the effective array when BPF F PREORDER programs are...

CVE-2026-74466: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-72162: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. CAUSE...

PT-2026-72748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vhost/vdpa component where the functions vhost vdpa mmap and vhost vdpa fault use vma-vm pgoff as a virtqueue index for get vq notification without validating that...

PT-2026-72350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the ocfs2 sum rightmost rec function. On-disk corruption that sets the l next free rec variable to 0 in an inode's embedded extent list can...

Linux Distros Unpatched Vulnerability : CVE-2026-72236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/perfcpumcf: Add missing arrayindexnospec to hwperfeventinit ev variable is userspace controlled via event-attr.config and used as an array index after boun...

Linux Distros Unpatched Vulnerability : CVE-2026-72162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec BUG On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers ...

PT-2026-72200

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/diag component where the memtop get page count function fails to use array index nospec. Because the level variable is controlled by user space and used to re...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the sender-side block matching process. An attacker can cause memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero, resulting in an...

CVE-2026-73564: Improper Validation of Array Index

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

CVE-2026-73489: Improper Validation of Array Index

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

PT-2026-69554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component where the crush decode function fails to reject zero bucket types. Since CRUSH bucket type 0 is reserved for devices, a malformed CRUSH map can...

Linux Distros Unpatched Vulnerability : CVE-2026-68154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify le...

Security update for libXfont2

This update for libXfont2 fixes the following issues: CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. CVE-2026-59679: fsreadglyphs heap OOB read/write via encoding array index mismatch bsc1272660. Patch Instructions: To install this SUSE update use...