EulerOS 2.0 SP15 : graphite2 (EulerOS-SA-2026-3978)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an...

CVE-2026-19186

An integer underflow vulnerability exists in the ieee802154_decipher_data_frame() function within subsys/net/l2/ieee802154/ieee802154_frame.c . The software fails to verify if a received frame is long enough before subtracting header and authentication tag lengths from the total length. Because t...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

CVE-2026-83742

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

EUVD-2026-94164

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742

The wolfSSL wolfSSH library (versions v1.4.11 through v1.5.0 ) is vulnerable on non-Windows platforms due to an unsigned integer underflow in the wstrncat() function within src/port.c. An authenticated remote attacker can trigger this by sending a crafted SFTP path to wolfSSH_RealPath() in src/ss...

CVE-2026-35330

CVE-2026-35330 Débordement de tas heap buffer overflow avant authentification dans l'analyseur d'attributs EAP-SIM / EAP-AKA de strongSwan via un dépassement négatif d'entier integer underflow. Description parseattributes dans src/libsimaka/simakamessage.c:419 lit les en-têtes TLV dont le champ...

DEBIAN-CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

DEBIAN-CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

DEBIAN-CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

AZL-106287 CVE-2026-98177 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

DEBIAN-CVE-2026-98177

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

AZL-106263 CVE-2026-98176 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...

DEBIAN-CVE-2026-98176

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...