EUVD-2026-49035

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323 udf: validate VAT header length against the VAT inode size

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64322 udf: validate sparing table length as an entry count, not a byte count

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64322

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64322

Mode C: Normal. The CVE-2026-64322 issue affects the Linux kernel UDF handling of sparing tables. The problem is that udf_load_sparable_map() validated reallocationTableLen as a byte count, while code walks the sparing table as an array of 8-byte entries, leading to potential out-of-bounds reads ...

EUVD-2026-49034

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

CVE-2026-64319 nvmet-auth: validate reply message payload bounds against transfer length

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

EUVD-2026-49031

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

CVE-2026-64319

CVE-2026-64319 refers to a Linux kernel vulnerability in the nvmet-auth path where DHCHAP/response payload bounds were not verified against the transfer length. The issue allows a malicious NVMe‑oF initiator to craft a DHCHAP_REPLY with small transfer length but large hl/dhvlen values, yielding o...

CVE-2026-64318 partitions: aix: bound the pp_count scan to the ppe array

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64299 tracing: Prevent out-of-bounds read in glob matching

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

CVE-2026-64299 tracing: Prevent out-of-bounds read in glob matching

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

EUVD-2026-49011

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64296

The CVE concerns the Linux kernel exFAT driver: in exfat_find_dir_entry(), processing directory NAME entries (TYPE_EXTEND) advances the output buffer by a fixed amount while the guard tracks name length, allowing an out-of-bounds read/write when name fragments are long/short. The bug arises becau...

EUVD-2026-49008

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64289 iommufd: Set upper bounds on cache invalidation entry_num and entry_len

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...