CLSA-2026-1792784815 poppler: Fix of CVE-2026-10118

CVE-2026-10118: fix integer overflow in SplashOutputDev::tilingPatternFill...

CVE-2026-98819

A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing Device Descriptor Configuration DDC records, the driver fails to properly validate record lengths, allowing integer wrapping and reading past buffer boundaries. An attacker capable of supplying crafted firmware data...

CVE-2026-89927

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. A local attacker, or a malicious guest operating system, could exploit an integer overflow vulnerability by programming a Hyper-V synthetic timer with a deadline in the past. This can prevent the CPU from maki...

CVE-2026-98816

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. An integer overflow occurs in the constant blinding mechanism when calculating backward jump offsets during BPF program hardening. A local attacker capable of loading BPF programs could exploit this issue to jump beyond...

Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability (CVE-2026-18142)

Summary IBM MQ Appliance has addressed an integer overflow vulnerability that could allow an authenticated attacker to cause a denial of service and perform limited memory corruption. Vulnerability Details CVEID:CVE-2026-18142 DESCRIPTION: IBM MQ for z/OS could allow a remote authenticated attack...

Security Bulletin: IBM MQ Appliance is affected by multiple vulnerabilities in Java SE

Summary IBM MQ Appliance has addressed multiple vulnerabilities in Java SE. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. CWE:CWE-696: Incorrec...

Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability (CVE-2026-11376)

Summary IBM MQ Appliance has addressed an integer overflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing subscription requests with crafted buffer size values. Vulnerability Details CVEID:CVE-2026-11376...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

DEBIAN-CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

DEBIAN-CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

UBUNTU-CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1791741836 kernel: Fix of 127 CVEs

md/raid1,raid10: strip REQNOWAIT from member bios CVE-2025-22125 - md/raid1: fix data lost for writemostly rdev CVE-2025-22125 - md/raid1,raid10: don't handle IO error for REQRAHEAD and REQNOWAIT CVE-2025-22125 - md/raid1,raid10: don't ignore IO flags CVE-2025-22125 - net/sched: netem: fix queue...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062

The Linux kernel contains a vulnerability in the vsock/virtio component where virtio_transport_read_skb() incorrectly manages byte accounting. After a partial stream receive, the function dequeues a packet but passes the full pkt_len for both buf_used and peer credit counters, causing rx_bytes to...

EUVD-2026-108728

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

DEBIAN-CVE-2026-98900

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...