CVE-2026-64269 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

EUVD-2026-48981

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64268

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

CVE-2026-64268

CVE-2026-64268 concerns a Linux kernel vulnerability in the SIW (RDMA) path where Read Response segments could overrun the sink buffer. The issue resides in siw_qp_rx.c (siw_proc_rresp) which places inbound Read Response DDP segments at sge->laddr + wqe->processed and accumulates processed ...

CVE-2026-64267 fuse: avoid 32-bit prune notification count wrap

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267

CVE-2026-64267 affects the Linux kernel’s FUSE (Filesystem in Userspace) path. The issue is an integer overflow in handling FUSE_NOTIFY_PRUNE messages on 32-bit architectures, where the product of outarg.count and sizeof(u64) can wrap during payload length validation, potentially causing the kern...

EUVD-2026-48979

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267 fuse: avoid 32-bit prune notification count wrap

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64257 smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

CVE-2026-64257

CVE-2026-64257 affects the Linux kernel SMB2 client logic. The issue arose from overlap handling in __smb2_calc_size(), where clearing data_length could cause an invalid SMB2 response to appear as if it has no data area, allowing an unintended length-exemption path. The fix tracks data area overl...

Libssh: libssh: denial of service via oversized sftp read length

...

SUSE CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

SUSE CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

PT-2026-64501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where afu ioctl dma map accepts a 64-bit length from userspace via the DFL FPGA PORT DMA MAP ioctl without an upper bound check. This value is passed to afu dma pin pages...

PT-2026-64725

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150 accel fifo flush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150 ACCEL FIFO LENGTH 3; which is...

PT-2026-64545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the UDF filesystem implementation where the udf free blocks function fails to include the extent offset when validating the logical block number and count against the...

PT-2026-64490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/rtrs-srv component where the rdma write sg function fails to validate the length of the RDMA-Write operation against the maximum chunk size. When responding t...

Linux Distros Unpatched Vulnerability : CVE-2026-64322

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst +...

Linux Distros Unpatched Vulnerability : CVE-2026-64440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof...

Linux Distros Unpatched Vulnerability : CVE-2026-64219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a...