UBUNTU-CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-71971

U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the...

UBUNTU-CVE-2026-71973

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

UBUNTU-CVE-2026-74225

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

UBUNTU-CVE-2026-71972

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader...

Important: Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update

An update is now available for Red Hat Lightspeed formerly Insights for Runtimes on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-74225

The U-Boot bootloader (versions before 2026.10-rc5 ) is vulnerable to an out-of-bounds write within the dhcp6_parse_options() function. This issue stems from a failure to properly validate the SERVERID and CLIENTID option lengths received in DHCPv6 packets. An attacker positioned on the local net...

CVE-2026-74225

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

CVE-2026-74220 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71972

U-Boot versions through 2026.10-rc5 are affected by an out-of-bounds write vulnerability in the video_display_rle8_bitmap function located in drivers/video/video_bmp.c. An attacker can exploit this by providing a crafted RLE8-compressed BMP image , which can lead to memory corruption adjacent to ...

CVE-2026-71972

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader...

CVE-2026-97937

A flaw was found in the Linux kernel. During process creation when the Function Tracer ftrace graph functionality is active, a memory allocation failure can lead to the kernel prematurely releasing memory still referenced by the parent process. A local attacker could exploit this use-after-free...

CVE-2026-97935

A flaw was found in the Linux kernel's tracing subsystem. A local user with access to configure event triggers can trigger a use-after-free condition, leading to a system crash, Denial of Service DoS, or potential privilege escalation. This issue occurs when registering a named histogram trigger...

CVE-2026-97490

A flaw was found in the Linux kernel's Amiga Fast File System AFFS driver. When mounting a filesystem, the driver fails to properly handle block size configuration failures. A local user with permissions to mount filesystems could exploit this flaw by mounting a specially crafted AFFS image,...

CVE-2026-102253

A flaw was found in iperf3. An unauthenticated remote attacker can exploit this issue by sending a crafted control-channel message followed by a specific User Datagram Protocol UDP datagram to the server. This causes the UDP receive processing thread to enter an unrecoverable infinite loop, leadi...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...