65060 matches found
CVE-2026-68158
CVE-2026-68158 (Linux kernel libceph) : A vulnerability in decoding CEPH_MSG_OSD_MAP can overflow when computing the length of the new_state portion, causing an overflowed bounds check and potentially out-of-bounds memory reads during osdmap decoding. The issue arises from a multiplication that m...
EUVD-2026-55525
In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...
CVE-2026-72688
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72688
CVE-2026-72688 concerns OpenSignLabs opensignserver (up to version 2.37.0). The flaw is a missing authentication vulnerability in the fileupload Parse cloud function, which mints MASTER_KEY-signed file access tokens for any caller-supplied URL without session verification. This allows an unauthen...
CVE-2026-68134 ptp: ptp_s390: Add missing facility check
In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...
CVE-2026-68134
The CVE-2026-68134 entry concerns the Linux kernel ptp_s390 module. The vulnerability arises from a missing facility check that could allow the physical clock to be registered even when facility 28 is not installed or PTFF QPT is unavailable. The public details in the connected sources indicate t...
CVE-2026-68125 mac802154: llsec: reject frames shorter than the authentication tag
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...
EUVD-2026-55499
In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...
CVE-2026-68114 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23...
EUVD-2026-55492
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...
EUVD-2026-55490
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...
EUVD-2026-55488
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...
CVE-2026-68099
The CVE-2026-68099 vulnerability is in ksmbd within the Linux kernel, where check_add_overflow() could cause an on-wire NT ACL to be malformed. In the affected DACL builders (set_posix_acl_entries_dacl() and set_ntacl_dacl()), overflow handling previously allowed the loop to break while the desti...
CVE-2026-68089
The CVE-2026-68089 entry concerns the Linux kernel iio core debugfs handling. It documents a vulnerability where uninitialized data could be exposed when *ppos is non-zero, because simple_write_to_buffer() would not initialize buf[]. The fix adds a test for non-zero *ppos at the start of the affe...
CVE-2026-68089 iio: core: fix uninitialized data in debugfs
In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...
CVE-2026-68088 usb: gadget: function: rndis: add length check to response query
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...
CVE-2026-68088
The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...
CVE-2026-68088
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...
CVE-2026-72584
A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...