EUVD-2026-48905

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

CVE-2026-64361 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

Linux Distros Unpatched Vulnerability : CVE-2026-64219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a...

PT-2026-64490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/rtrs-srv component where the rdma write sg function fails to validate the length of the RDMA-Write operation against the maximum chunk size. When responding t...

PT-2026-64726

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis rm hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

PT-2026-64633

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request module...

PT-2026-64582

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check and correct requested length check and correct requested length compares off + len against node size using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed...

Linux Distros Unpatched Vulnerability : CVE-2026-64324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops th...

DEBIAN-CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64219

CVE-2026-64219 affects the Linux kernel drm/amd/display path, specifically dc_process_dmub_aux_transfer_async, where payload->length is copied into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(). If length > 16, this can cause a stack-based overflow; additionally, dc-&g...

SUSE CVE-2026-63904

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

PT-2026-62127

The Classic BR/EDR L2CAP signaling handlers l2cap br conf req and l2cap br conf rsp in subsys/bluetooth/host/classic/l2cap br.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-63886

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

CVE-2026-64102 RDMA/siw: Reject MPA FPDU length underflow before signed receive math

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

CVE-2026-64083

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...