CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72114

In the Linux kernel CAN BCM subsystem, CVE-2026-72114 is due to bcm_rx_setup() not validating the frame length for RTR-reply frames configured via RX_SETUP with RX_RTR_FRAME, unlike bcm_tx_setup() which validates cf->len against CAN/CAN FD DLC limits. The vulnerability is resolved by adding va...

CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

EUVD-2026-59102

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-72003 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-72003 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

EUVD-2026-59092

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

The CVE-2026-68470 vulnerability affects the Linux kernel’s wifi/mac80211 path. It occurs when validating extension-frame layout before RX, allowing extension subtypes beyond S1G beacons to reach regular-header RX processing and potentially read header addresses. The fix narrows RX routing to han...

PT-2026-72192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf notify auth frame rx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt frame len =...

CVE-2026-72114: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72296: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...

PT-2026-72182

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 wireless driver where extension frames are not properly validated before being processed by the receive RX path. Because extension frames place the...

CVE-2026-68470: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

PT-2026-73010

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

CVE-2026-74497: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

Linux Distros Unpatched Vulnerability : CVE-2026-72115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no...

Linux Distros Unpatched Vulnerability : CVE-2026-68470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX pa...

s2n-quic has excessive memory allocation

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a singl...