EUVD-2026-55373

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-25289

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

EUVD-2026-52737

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-64547

A flaw was found in the Linux kernel's net1080 USB network adapter driver. A malicious NetChip 1080 device could send a specially crafted network frame with an invalid packet length. This could lead to an out-of-bounds read when processing the packet, causing a system crash and resulting in a...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822 Key Record using PRIVATEDNS algorithm may lead to unexpected exit

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822 Key Record using PRIVATEDNS algorithm may lead to unexpected exit

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

i2c: stub: Reject I2C block transfers with invalid length

...

SUSE CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

EUVD-2026-46011

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-64191

The CVE-2026-64191 issue affects the Linux kernel i2c-stub driver (CONFIG_I2C_STUB=m) where I2C_SMBUS_I2C_BLOCK_DATA did not validate data->block[0] against I2C_SMBUS_BLOCK_MAX, allowing out-of-bounds access when an I2C_SMBUS_IOCTL with a block length > 32 is issued. The bug contrasts with ...

CVE-2026-64191 i2c: stub: Reject I2C block transfers with invalid length

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects

A flaw was found in openCryptoki, a PKCS11 Cryptographic Token Interface Standard library. The BER/DER Basic Encoding Rules/Distinguished Encoding Rules decoding functions in the shared common library do not properly validate attacker-controlled length fields against actual buffer boundaries. Thi...

CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...

CVE-2026-44893

Netty CVE-2026-44893 affects netty-codec-haproxy prior to 4.1.135.Final and 4.2.15.Final. During PP2_TYPE_SSL TLV decoding, HAProxyMessage.readNextTLV() retains a slice before reading the client (1 byte) and verify (4 bytes). If TLV length

CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...

CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

When decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException...