PT-2026-90527

stb vorbis through 1.22 contains a heap buffer overflow in start decoder where the codebook multiplicands allocation size is truncated from size t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process...

PT-2026-90094

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

PT-2026-90099

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

PT-2026-90092

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache info cache segs init iterates cache info-n segs times indexing cache-segments, which is sized to the cache device geometry, and get seg id takes each segment id from the...

PT-2026-90116

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max recv sge == 1 there is no shared v2 receive buffer, and smc llc save add link rkeys takes the v2 extension from 44 bytes past the start of...

PT-2026-90106

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap and validate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

PT-2026-90095

In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

PT-2026-90067

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915 mcu get eeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

PT-2026-90328

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse ntfs boot sector decoded them into an s64. A crafted high-bit value could therefore becom...

PT-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes handle arm hw error, after skipping the cper sec proc arm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeofe...

PT-2026-90253

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss krb5 verify mic v2 gss krb5 verify mic v2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSS KRB5 TOK HDR LEN and cksum len to gss...

PT-2026-90421

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq status counter to even on all nfsd dispatch exit paths nfsd dispatch sets rq status counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a...

PT-2026-90442

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen Patch series "lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2 strnlen. The first patch is the re...

PT-2026-90088

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache replay, the writeback worker and the GC worker bounds its length by PCACHE SEG SIZE - seg off, the raw segment size rather than the data...

PT-2026-90063

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

PT-2026-90240

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl cfg80211 connect event subtracts fixed IE offsets from assoc req len -= 4 and assoc resp len -= 6, both u8, with no lower bound. The aggregat...

PT-2026-90272

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf validity cache sechdrs, section sizes and offsets are validated, unless the section type is SHT NULL or SHT NOBITS. Later, elf validity cache secstrings and elf validity cache...

PT-2026-90327

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs attr update meta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed size field before the name and...

PT-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted key size in parse tag 3 packet parse tag 3 packet set encrypted key size from the Tag 3 packet body without bounding it against ECRYPTFS MAX KEY BYTES 64. When encrypted key size 64, decrypt...