PT-2026-72278

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw log from bo validates the tracing buffer header size and that the log fits within the BO, but never checks that log-size is at least log-header size. fw log print...

PT-2026-72383

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr off in UpdateResidentValue against data off In do action's UpdateResidentValue case fslog.c:3307, lrh-attr off and lrh-redo len come from the on-disk LRH. When they satisfy aoff + dlen res.data off, the...

PT-2026-72429

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

PT-2026-73009

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi scsi cmd rsp copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense...

EUVD-2026-57922

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...

The vulnerability of the phy/st/phy-stm32-usbphyc.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the phy/st/phy-stm32-usbphyc.c component in the Linux operating system is related to reading data from the buffer beyond its allowable limits. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-68447

A flaw was found in the Linux kernel's drm/amdkfd component. The Checkpoint/Restore in Userspace CRIU checkpoint process, which saves and restores the state of a running application, incorrectly copies the Memory Queue Descriptor MQD control stack. This occurs because the copy operation does not...

CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

DEBIAN-CVE-2026-68431

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the...

The vulnerability of the functions bitPutcs_aligned() and bitPutcs_unaligned() in the Linux kernel’s drivers/video/fbdev/core/bitblit.c file, which allows a hacker to cause a service failure.

The vulnerability of the functions bitPutcsaligned and bitPutcsunaligned in the Linux kernel’s drivers/video/fbdev/core/bitblit.c module lies in the handling of data buffer sizes that exceed acceptable limits. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE SLED15: freerdp / freerdp-devel / freerdp-proxy / freerdp-proxy-plugins / etc (SUSE-SU-2026:3562-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3562-1 advisory. - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in StreamEnsureCapacity bsc1258939...

Windows Event Logging Service Information Disclosure Vulnerability

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Win32k Information Disclosure Vulnerability

Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally...

Security update for ImageMagick

This update for ImageMagick fixes the following issue: CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check bsc1272953. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for freerdp

This update for freerdp fixes the following issues: CVE-2026-27951: 32-bit system denial of service via endless blocking loop in StreamEnsureCapacity bsc1258939. CVE-2026-33952: client denial of service via unvalidated authentication length field bsc1261196. CVE-2026-33977: client denial of servi...

DEBIAN-CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

UBUNTU-CVE-2026-68339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68348 ASoC: tas2781: bound firmware description string parsing

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen before checking that the string terminator is present inside the firmware blob. A...

EUVD-2026-55449

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen before checking that the string terminator is present inside the firmware blob. A...

CVE-2026-68348

The CVE-2026-68348 entry relates to the Linux kernel ASoC TAS2781 firmware parser, where variable-length description strings are read with strlen() before ensuring a NUL terminator exists in the firmware blob. This could allow the parser to read past the end of the firmware buffer. A fix was impl...