CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

CVE-2026-98096

The Linux kernel contains a vulnerability in its IPv6 Segment Routing (SR) handling. The ipv6_srh_rcv() function incorrectly calculates the skb->data position by assuming the SRH immediately follows the fixed IPv6 header. If a preceding extension header (e.g., Hop-by-Hop options ) exists, skb_...

EUVD-2026-86926

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2026-98097

The Linux kernel contains a vulnerability in the tipc component where RESET/ACTIVATE messages could transmit random pad bytes to a remote system. This occurs because the interface name is passed in a fixed-length buffer using strcpy(), which fails to properly zero-pad the remaining bytes. The iss...

CVE-2026-98096 ipv6: sr: restore network header before routing and forwarding

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

EUVD-2026-86790

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...

CVE-2026-97934

The Linux kernel is vulnerable to memory corruption within the tracing subsystem. The issue arises because generic fields like "STACKTRACE" are mapped to placeholders instead of NULL by parse_field() . Consequently, create_hist_field() interprets data from the common_type field as an offset, lead...

EUVD-2026-86788

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

EUVD-2026-86784

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

CVE-2026-97930

The Linux kernel contains a vulnerability in the ALSA: usbusx2y component due to an array size mismatch between in04_last and in04_buf. Specifically, in04_last is declared as 24 bytes, while in04_buf is allocated as 21 bytes. This causes a buffer over-read in the i_usx2y_in04_int() function durin...

CVE-2026-97612

The Linux kernel is vulnerable to a memory corruption issue in the MPLS stack. The skb_mpls_push() function records a pre-encapsulation network header but skb_mpls_pop() fails to clear it when the last label is popped. This allows Open vSwitch to re-push MPLS onto a packet where the inner_network...

CVE-2026-97560

The Linux kernel contains a one-byte out-of-bounds (OOB) read vulnerability within the smb2_parse_native_symlink() function of the SMB client. The flaw occurs when parsing a share-root relative native symlink, where memcpy copies smb_target+1 (skipping the leading separator) but incorrectly uses ...

CVE-2026-23002-5G-NAS-Message-Buffer-Overflow-in-gNodeB

CVE-2026-23002 – 5G NAS Message Buffer Overflow in gNodeB Program Code C simulation root@kitploit: // gnbnassim.c - Simulated 5G gNodeB parsing NAS Registration Request include include include define MAXIESIZE 128 void processregistrationrequestuint8t nasmsg, uint16t length uint8t...

AFD

AFD CVE-2022-24494 The vulnerability is an arbitrary memory read. The root cause is a lack of validation in a memory address suplied from user-land that is used in a memcpy operation in order to copy data from this memory address into the pool memory. The lack of check is in the addres...

CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2020-0022

CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...

DEBIAN-CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

DEBIAN-CVE-2026-97427

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...