EUVD-2026-16132

Each RPCSECGSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not...

CVE-2026-4747 Remote code execution via RPCSEC_GSS packet validation

Each RPCSECGSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not...

RockyLinux 8 : kernel (RLSA-2026:3963)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3963 advisory. kernel: ipv6: BUG in pskbexpandhead as part of calipsoskbuffsetattr CVE-2025-71085 kernel: macvlan: fix possible UAF in macvlanforwardsource CVE-2026-230...

FreeBSD : FreeBSD -- Remote code execution via RPCSEC_GSS packet validation (733febba-28d2-11f1-b35e-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 733febba-28d2-11f1-b35e-bc241121aa0a advisory. Each RPCSECGSS data packet is validated by a routine which checks a signature in the packet. This routi...

PT-2026-36373

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vxlan na create function where ND options are processed based on lengths provided within the options. A malformed option can cause the parser to advance beyond the...

PT-2026-35016

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel due to uninitialized padding bytes in the build polexpire function. While the build expire function correctly clears trailing padding bytes of th...

The vulnerability of the rproc_coredump_write() function in the drivers/remoteproc/remoteprocdebugfs.c driver of the Linux kernel’s remote processor subsystem allows a attacker to compromise the integrity of protected information or cause service failures.

The vulnerability of the rproccoredumpwrite function in the drivers/remoteproc/remoteprocdebugfs.c driver of the Linux kernel’s remote processor subsystem is related to a numerical order loss or cyclic shift. Exploiting this vulnerability could allow an attacker to compromise the integrity of...

FreeBSD-SA-26:08.rpcsec_gss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:08.rpcsecgss Security Advisory The FreeBSD Project Topic: Remote code execution via RPCSECGSS packet validation Category: core Module: rpcsecgss Announced:...

MiracleLinux 9 : kernel-5.14.0-611.41.1.el9_7 (AXSA:2026-356:22)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-356:22 advisory. kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save CVE-2025-39818 kernel: mlxsw: spectrummr: Fix use-after-free...

EUVD-2026-15350

In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace not with vendor namespaces, but if the undefined field 18 is used, the alignment/size is unknown as well. In...

EUVD-2026-15272

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk-pm.localaddrused == 0 WARNING: net/mptcp/pmkernel.c:1071 at...

CVE-2026-23317

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmwtranslateptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code...

UBUNTU-CVE-2026-23346

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremapprot The only caller of ioremapprot outside of the generic ioremap implementation is genericaccessphys, which passes a 'pgprott' value determined from the user mapping of the target...

UBUNTU-CVE-2026-23374

In the Linux kernel, the following vulnerability has been resolved: blktrace: fix thiscpuread/write in preemptible context tracingrecordcmdline internally uses thiscpuread and thiscpuwrite on the per-CPU variable tracecmdlinesave, and tracesavecmdline explicitly asserts preemption is disabled via...

CVE-2026-23307

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: emsusbreadbulkcallback: check the proper length of a message When looking at the data in a USB urb, the actuallength is the size of the buffer passed to the driver, not the transferbufferlength which is set by the...

UBUNTU-CVE-2026-23290

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not...

CVE-2026-23388

CVE-2026-23388 concerns the Linux kernel Squashfs subsystem. A corrupted index lookup can yield a negative metadata block offset, leading to an out-of-bounds access in squashfs_copy_data via squashfs_read_metadata. The issue is resolved by adding a metadata offset range check in squashfs_read_met...

CVE-2026-23389 ice: Fix memory leak in ice_set_ringparam()

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in icesetringparam In icesetringparam, txrings and xdprings are allocated before rxrings. If the allocation of rxrings fails, the code jumps to the done label leaking both txrings and xdprings. Furthermore, i...

CVE-2026-23388 Squashfs: check metadata block offset is within range

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfscopydata" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offse...

CVE-2026-23371

CVE-2026-23371 (Linux kernel SCHED_DEADLINE) details (from provided docs): The vulnerability arose when a SCHED_DEADLINE task (often a lock holder) moved to a lower class via sched_setscheduler() and failed to inherit the donor DEADLINE parameters, risking bandwidth accounting corruption because ...