Unity Linux 20.1070e Security Update: graphite2 (UTSA-2026-099523)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099523 advisory. Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the...

CVE-2026-45698: Integer Underflow (Wrap or Wraparound)

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...

Moderate: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer1-plugins-good: gstreamer: unsigned integer...

ALSA-2026:55434 Moderate: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer1-plugins-good: gstreamer: unsigned integer...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100570)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100570 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfre...

clamav: Fix of 6 CVEs

CVE-2026-20213: fix Aspack-triggered PE rebuild integer overflow leading to heap buffer overflow write - CVE-2026-20214: fix FSG unpacker section loop underflow leading to out-of-bounds write - CVE-2026-20215: fix 7z substream count overflow leading to heap under-allocation and out-of-bounds...

CVE-2026-74444

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

CVE-2026-74470 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-74470 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-74444 drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

CVE-2026-74444

The vulnerability CVE-2026-74444 affects the Linux kernel DRM vmwgfx driver. In vmw_cmd_draw, the header size from user input can cause an unsigned subtraction (header->size - sizeof(cmd->body)) to wrap to ~4 GiB when header->size is undersized, leading to a large maxnum and an out-of-bo...

EUVD-2026-59751

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72326

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...