PT-2026-90330

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcn empty bits per page is sized from vol-nr clusters at mount, but ntfs cluster alloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

PT-2026-90337

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221 raw event mcp2221 raw event never validates the size of incoming HID reports. In the MCP2221 I2C GET DATA path it trusts the device-supplied data3 as the copy length without checking...

PT-2026-90318

In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z erofs gbuf nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged...

PT-2026-90459

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm sendrecv msg locked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy...

PT-2026-90333

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR PAGE ENTRY ends in a page lcns array whose length is the on-disk lcns follow field. check rstbl validates the table bookkeeping but never checks that this array fits in t...

PT-2026-90331

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

PT-2026-90312

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv suspend and nv resume walk the non-PCI configuration space with for i = 0; i register size/sizeofu32; i++ which runs one iteration too many. saved config spa...

PT-2026-90296

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf get stack get perf callchain returns a per-CPU perf callchain entry buffer and releases its recursion slot via put callchain entry before returning, so nothing keeps the entry reserved while bpf get...

PT-2026-90326

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90390

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4 ff encode layoutget The XDR buffer size calculation in nfsd4 ff encode layoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memor...

PT-2026-90440

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc s fmt vid out sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt fwht, whose sizeimage mult is 3: coded w coded h 3 + sizeofstruct fwht cframe hdr...

PT-2026-90435

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read block state read block state calculates nr pages before taking dev lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr pages still describes th...

PT-2026-90439

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs direct propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs direct propagate during testing. Analysis revealed that after truncating a...

PT-2026-90365

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-90141

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hp init bios package attribute validates obj-package.count and then calls one of the five ...

Linux Distros Unpatched Vulnerability : CVE-2026-79514

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the gfdmdatareceived function downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTT...

Oracle Linux 8 : ELSA-2026-66348-0: / vim (ELSA-2026-663480)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663480 advisory. - RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator - RHEL-215662 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes -...

ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

Overview An out-of-bounds OOB memory access vulnerability involving unchecked array indexing has been identified in the exllamav3ext compute unified device architecture CUDA extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2026-89156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. CVE-2026-89156 Note that Nessus relie...