Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the JNX decoder. An attacker can cause a heap buffer over-write by processing extremely large files on 32-bit builds. Remediation A fix was pushed into the master branch but not yet published. Reference...

CVE-2026-64254

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

DEBIAN-CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

UBUNTU-CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...

UBUNTU-CVE-2026-64250

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit 9f3f3bdc6d9dac1 "MIPS: smp: report dying CPU to RCU in stopthiscpu". smpsendstop parks all secondary CPUs in stopthiscpu. And the function marks the...

EUVD-2026-44935

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions...

CVE-2026-64255

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

CVE-2026-64254 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

CVE-2026-64254

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pciiounmap with offset when PEERSPAD and CONFIG share BAR When BARPEERSPAD and BARCONFIG share one PCI BAR, the module teardown path ends up calling pciiounmap on the same iomem with some offset, which is...

CVE-2026-64253

The CVE-2026-64253 issue affects the Linux kernel, specifically in kernel/fork within copy_process(). The bug allowed PF_BLOCK_TS to be inherited from the parent after the child’s plug pointer is reset to NULL, breaking the invariant that PF_BLOCK_TS can only be relied upon when current->plug ...

CVE-2026-64251

CVE-2026-64251 concerns a Linux kernel bug in the pwrseq core where use-after-free occurs in the pwrseq_debugfs_seq_next() path due to incorrect reference counting. The fix standardizes reference management across seq_file callbacks to prevent prematurely dropped references: start() now returns a...

CVE-2026-64249

In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in childregionswithfirmware Move ofnodeputchildregion after the error print to avoid accessing freed memory when prerr references childregion. Yilun: Fix the Fixes tag...

CVE-2026-64248 MIPS: smp: report dying CPU to RCU in stop_this_cpu()

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-64248 MIPS: smp: report dying CPU to RCU in stop_this_cpu()

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-64247

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank the TLFS allows for a maximum o...

CVE-2026-64246

In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstationpoweroffinit Move ofnodeputdn after the ofmatchnode call, which still needs the node pointer. The node reference is correctly released after use...

CVE-2026-64238

The CVE-2026-64238 issue affects the Linux kernel GPIO subsystem for shared GPIO proxies. A previously wide-critical-section around a mutex in struct gpio_shared_entry could deadlock during removal of a shared proxy’s parent because the offset field could be modified after assignment. The fix sho...

CVE-2026-64236 i2c: davinci: fix division by zero on missing clock-frequency

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...