EUVD-2026-87745

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' multimodal payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied...

cve-2011-4862

cve-2011-4862 I originally tried to use diff to make a patch. I patched it the way I thought it would be, before looking at the real patch. encrypt.patch is this original patch that I made with teh diff. However, when we tried applying this patch to freeBSD, it would not accept it. Instead, we ha...

CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

AZL-104355 CVE-2026-97984 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

DEBIAN-CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

UBUNTU-CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

UBUNTU-CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-98145

The Linux kernel contains a vulnerability in the accel/amdxdna driver where a command chain with a command_count of zero improperly passes payload length checks. Because the struct_size calculation only accounts for the header, the fill loop is skipped, resulting in the submission of a zero-lengt...

CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-97984 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97984 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

EUVD-2026-86638

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97984

The Linux kernel contains a vulnerability where UDP sockets can experience a UDP length overflow when using IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE options. This occurs when sending a large packet over a network device with an unusually large MTU (greater than IP6_MAX_MTU), causing the 16-bit len...

CVE-2026-97621

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: fix unchecked bound endpoint name length rockchipdpdrmencoderenable uses sprintf to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficientl...

CVE-2026-97546 xfs: don't spin forever on zero-length dirents when salvaging them

In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...