EUVD-2026-75879

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

EUVD-2026-75759

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack...

PT-2026-90436

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs sb verify signature bounds the on-disk ubifs sig node-len field before handing the signature payload to verify pkcs7 signature, but the check has the wrong sign: if le...

PT-2026-90182

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom battmgr: terminate the strings from firmware The qcom battmgr sc8280xp strcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR STRING LEN bytes and leaves the destinatio...

PT-2026-90166

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID MATCH field tegra241 vintf init vsid programs the guest-provided vSID into SID MATCH, whose VIRT SID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefo...

PT-2026-90132

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp convert zc to xdp frame clones an XSK packet into an order-0 page and advertises PAGE SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb shared info and...

PT-2026-90308

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket job push rocket job push allocates a temporary array to hold all input and output GEM object pointers: bos = kvmalloc arrayjob-in bo count + job-out bo count,...

PT-2026-90248

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl for each segment for empty chunks When a parsed chunk list contains a chunk whose ch segcount is zero, pcl for each segment computes its inclusive upper bound as &chunk-ch segmentsch segcount - 1. ch segcount is...

PT-2026-90346

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data offset bound in is valid oplock break Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smb hdr" changed the quantity this bound is measured against. It used to be srv-total read minus the...

PT-2026-90102

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

PT-2026-90470

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walk pmd range If -pmd entry sets walk-action = ACTION AGAIN, the pmd none check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-install pte is...

PT-2026-90434

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback store Patch series "zram: fix stale scan bounds after reinitialization". Both writeback store and read block state derive their table scan bounds from zram-disksize before acquiring dev...

PT-2026-90081

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max payload len svc i3c master handle ibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVC I3C FIFO SIZE, not by the...

PT-2026-90438

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci write legacy io pci write legacy io loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; retur...

PT-2026-90369

In the Linux kernel, the following vulnerability has been resolved: ceph: reject export targets ranks = CEPH MAX MDS in mdsmap decode MDSMap export targets entries are monitor controlled. check new map uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespa...

PT-2026-90477

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa vec unique null terminates at vecn - dups when VEC FLAG TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

PT-2026-90147

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensor num. cros ec sensorhub ring handler validates the FIFO event count, the per-read count and the ring bound...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-90159

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst if get perf level mask and isst if get base freq mask use the user-provided level as an index into perf levels via read pp level info and read bf level info, but neither...

PT-2026-90073

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du tx fill desc uses ieee80211 get tid to read the QoS TID from the 802.11 header and then uses it as an index into sta entry-tids. ieee80211 get tid returns the l...