PT-2026-98655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vdpasim blk check range function where it logs an invalid start sector but continues validating the request. This leads to an unsigned capacity subtraction...

PT-2026-98716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the ASOC Intel AVS component. The problem occurs when the system accesses entries in the init configs array using indexes from the config ids arra...

PT-2026-98720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the persistent ring buffer validation where the system uses the nr subbufs variable without verifying that it matches the expected value of nr pages + 1. This lack of...

PT-2026-98751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array read occurs in the base assign reply queues function within the mpt3sas SCSI driver. This happens because the dev to node function can return NUMA NO NODE -1 on...

PT-2026-98772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btintel component where the firmware ID is treated as a NUL-terminated string despite the TLV Type-Length-Value length being its only boundary. If the...

PT-2026-98773

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel parse version tlv function fails to ensure that the value length is sufficient for the specific Type-Length-Value TLV type...

CVE-2026-97930: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

CVE-2026-97930

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

Linux Distros Unpatched Vulnerability : CVE-2026-97930

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as...

ROS-20260925-73-0007

The vulnerability of the function vb2opsvdecqueuesetup in the driver/media/platform/mediatek/vcodec/mtkvcodecdec.c file of the Linux kernel-based multimedia device drivers involves reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failu...

ROS-20260925-73-0079

The vulnerability of the legacyloadclusterfromdisk function in the fs/erofs/zmap.c file of the EROFS file system’s kernel in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to...

ROS-20260925-73-0193

The vulnerability of the realtekmdioprobe function in the driver/net/dsa/realtek/realtek-mdio.c file of the Linux kernel’s DSA driver is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

ROS-20260925-73-0191

The vulnerability of thehdrfinde function in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-98107

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-80431: Out-of-bounds Write

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

PT-2026-99013

PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the...

CVE-2026-97548: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount maxlevelsondisk functions The maxlevelsondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount...

CVE-2026-97580: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

CVE-2026-98155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...