Linux Distros Unpatched Vulnerability : CVE-2026-90103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body...

DEBIAN-CVE-2026-90103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

AZL-102644 CVE-2026-90103 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

EUVD-2026-81696

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103

CVE-2026-90103 is a buffer sizing flaw in the Linux kernel's NFSv4.2 flexfiles layout driver . The encode_layoutstats_maxsz macro budgets only 256 bytes for the layoutupdate4 body, but a per-data-server flexfiles record (filehandle + IO latency entries + nfstime4 + bool) can exceed that, especial...

CVE-2026-90103 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099009 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames...

CVE-2026-74626

A flaw was found in the Linux kernel's Non-Transparent Bridge NTB virtual ethernet device ntbnetdev. When processing incoming network packets, a failure to allocate a new buffer can lead to the removal of an existing buffer from the receive queue without replacement. Repeated occurrences of this...

CVE-2026-65324

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgra...

Apache ActiveMQ resource management error vulnerability (CNVD-2026-28241)

ActiveMQ is an open-source messaging middleware from Apache, used for message queues and asynchronous communication. There is a resource management vulnerability in Apache ActiveMQ. The vulnerability arises due to the STOMP NIO codec’s ability to infinitely buffer unterminated header bytes...

EUVD-2026-40278

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM hea...

CVE-2026-13351

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer allocated from a memory...

Linux Distros Unpatched Vulnerability : CVE-2026-46110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC,...

CVE-2026-45884

A flaw was found in the Linux kernel's AppArmor module. A local attacker could exploit an integer underflow vulnerability in the aagetbuffer function. This flaw prevents buffers from being returned to the global list, potentially leading to resource exhaustion and a Denial of Service DoS conditio...

Linux Distros Unpatched Vulnerability : CVE-2026-46088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames advances pointer p through the names buffer while decrementing...

CVE-2026-42583

CVE-2026-42583 (Netty) affects Netty’s Lz4FrameDecoder. Before versions 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf sized to decompressedLength (up to 32 MB per block) prior to running the LZ4 step. A peer can trigger this allocation with only a 21-byte header plus compres...

.NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to...