EUVD-2026-67546

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

CVE-2026-80670

CVE-2026-80670 affects the Linux kernel perf tools subsystem. The function machine__resolve() accesses env->cpu[al->cpu].socket_id after validating al->cpu >= 0 and env->cpu != NULL, but fails to validate al->cpu against env->nr_cpus_avail. Because al->cpu originates from ...

CVE-2026-80609 qede: fix out-of-bounds check for cqe->len_list[]

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-80609

This vulnerability affects the qede (Qualcomm Ethernet) driver in the Linux kernel . The root cause is an out-of-bounds access on the cqe->len_list[] array, where the index bounds check was performed after the element was already accessed, allowing an out-of-bounds read or write. The fix moves...

EUVD-2026-67485

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-80609 qede: fix out-of-bounds check for cqe->len_list[]

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-80598 ntfs3: fix out-of-bounds read in decompress_lznt

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...

CVE-2026-80598

CVE-2026-80598 is an out-of-bounds read in the Linux kernel's ntfs3 filesystem, specifically in the decompress_lznt() function. The root cause is a missing array index bounds validation before accessing the decompression table; a corrupted NTFS3 image with invalid compressed data can trigger the ...

Linux Distros Unpatched Vulnerability : CVE-2026-80598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

UBUNTU-CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

Linux Distros Unpatched Vulnerability : CVE-2026-80670

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but withou...

CVE-2026-81334

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

CVE-2026-80552

A flaw was found in the s390/vfioccw component of the Linux kernel. This vulnerability occurs because the system fails to properly validate index ranges for read/write operations on existing regions. This oversight could allow an attacker to perform out-of-bounds memory access, potentially leadin...

CVE-2026-81334 darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

CVE-2026-81334 darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

CVE-2026-81334

darknet through 6.0 is vulnerable to an out-of-bounds read and write in its .cfg parser. The layer array in src-lib/darknet_network.cpp is sized to the declared number of layer sections, but the shortcut, scale_channels, and sam sections (via their from field) and the route section (via its layer...

EUVD-2026-67031

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

EUVD-2026-66467

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

EUVD-2026-66572

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...