CVE-2026-93808

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

PT-2026-104866

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb ep1 command reply dispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93808: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

Linux Distros Unpatched Vulnerability : CVE-2026-93808

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the...

CVE-2026-93280

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

CVE-2026-89944

A flaw was found in the Linux kernel's Audio System on Chip ASoC High Definition Audio Codec hdachda component. During the device probing process, a reference to an HDA link is acquired but not properly released if the ASoC component registration fails. This oversight leads to a reference count...

CVE-2026-93841

A flaw was found in vLLM. This memory corruption vulnerability exists in the Triton bincountkernel, where prompt token identifiers IDs are used to index a bitset without proper bounds checking against the vocabulary size. A remote attacker can exploit this by submitting multimodal audio requests...

[SECURITY] Fedora 45 Update: xmms2-0.9.7-8.fc45

XMMS2 is an audio framework, but it is not a general multimedia player - it will not play videos. It has a modular framework and plugin architecture for audio processing, visualisation and output, but this framework has not been designed to support video. Also the client-server design of XMMS2 an...

[SECURITY] Fedora 45 Update: qmmp-2.3.3-5.fc45

This program is an audio-player, written with help of Qt library. The user interface is similar to winamp or xmms. Main opportunities: Winamp and xmms skins support plugins support AAC support MPEG1 layer 2/3 support Ogg Vorbis support native FLAC support WavePack support ModPlug support PCM WAVE...

[SECURITY] Fedora 45 Update: qmplay2-26.08.02-2.fc45

QMPlay2 is a video and audio player. It can play all formats supported by FFm peg. It also supports Audio CD, raw files and chiptunes. It contains YouTube brows er...

[SECURITY] Fedora 45 Update: openal-soft-1.24.2-10.fc45

OpenAL Soft is an LGPL-licensed, cross-platform, software implementation of t he OpenAL 3D audio API. It's forked from the open-sourced Windows version availa ble originally from openal.org's SVN repository now defunct. OpenAL provides capabilities for playing audio in a virtual 3D environment...

[SECURITY] Fedora 45 Update: libopenshot-audio-0.6.0-2.fc45

OpenShot Audio Library libopenshot-audio is an open-source project based on JUCE, and enables high-quality audio editing and playback for libopenshot...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bluez (UTSA-2026-054081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054081 advisory. BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in...

SUSE CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

SUSE CVE-2026-89892

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits...

Out-of-bounds Write

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Out-of-bounds Write via the Triton bincountkernel, where prompt token IDs index the penalty prompt-presence bitset without bounds checking against t...

PYSEC-0000-CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

CVE-2026-93841

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton bincountkernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...