CVE-2026-64243 ASoC: codecs: simple-mux: Fix enum control bounds check

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simplemuxcontrolput rejects values greater than e-items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so valu...

CVE-2026-64237

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

CVE-2026-64225

Linux kernel CVE-2026-64225 affects octeontx2-af CGX: cgx_speed_mbps has 13 elements, but RESP_LINKSTAT_SPEED can yield 0–15, leading to out-of-bounds access and potential memory corruption/System crash. The fix adds a bounds check and defaults the speed to 0 when index is out of range. Affected ...

CVE-2026-64225 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13, this causes an out-of-bounds array access. Add a bounds check and...

EUVD-2026-48633

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13, this causes an out-of-bounds array access. Add a bounds check and...

CVE-2026-64225 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13, this causes an out-of-bounds array access. Add a bounds check and...

CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which is a...

CVE-2026-64219 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-64219

CVE-2026-64219 affects the Linux kernel drm/amd/display path, specifically dc_process_dmub_aux_transfer_async, where payload->length is copied into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(). If length > 16, this can cause a stack-based overflow; additionally, dc-&g...

PT-2026-64405

Name of the Vulnerable Software and Affected Versions onnx affected versions not specified Description A heap-buffer-overflow read occurs in the Gemm 7 6::adapt gemm 7 6 function when ConvertVersion processes a model containing a Gemm node with input tensors having fewer than two dimensions. The...

PT-2026-64381

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 Description A missing bounds check in the publickey subsystem allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and the free of an uninitialized pointer. In the libssh2...

PT-2026-64340

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access occurs in the octeontx2-af driver. The cgx speed mbps array contains 13 elements, but the RESP LINKSTAT SPEED value can range from 0 to 15. When RESP LINKST...

PT-2026-64358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC codecs simple-mux component where the simple mux control put function fails to properly validate enum control bounds. Because enum control values are...

PT-2026-64334

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack buffer overflow occurs in the dc process dmub aux transfer async function when payload-length bytes are copied into a 16-byte stack buffer dpaux.data16. Because the check is...

SUSE-SU-2026:3212-1 Security update for multipath-tools

This update for multipath-tools fixes the following issues Update to version 0.7.9+238+suse.1249506. - kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk imagebsc1268145. - kpartx: missing bounds check can lead to a DASD...

CVE-2026-13077

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

CVE-2026-13077

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

CVE-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

CVE-2026-64833

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...