Mozilla -- Memory safety bugs

https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/CVE-2026-16411 reports Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code...

GHSA-9HW9-CH79-4VH6 Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Summary Pillow's public ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as RGBA - RGBA can be applied to an L output...

CVE-2026-64188

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoint from the hash table with hlistdelinitrcu and then immediately frees it with kfree. However, RCU readers on the receive path...

Linux Distros Unpatched Vulnerability : CVE-2026-64188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoint from the hash table with hlistdelinitrcu and then immediatel...

Linux Distros Unpatched Vulnerability : CVE-2026-64044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls...

Linux Distros Unpatched Vulnerability : CVE-2026-63966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550triggerhandler declares the...

CVE-2026-63965

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580triggerhandler declares its scan buffer on the stack without an initializer and then memcpys 3 bytes of 24-bit sensor data into each 4-byte le32 field. The hig...

CVE-2026-63894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

EUVD-2026-45807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

CVE-2026-64087 hwmon: (pmbus/adm1266) reject implausible blackbox record_count

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

EUVD-2026-45653

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64015 security/keys: fix missed RCU read section on lookup

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...

EUVD-2026-45587

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size nexioreaddata pulls datalen and xlen from a packed be16 header in the device's interrupt packet and then walks packet-data0..xlen and packet-dataxlen..datalen...

EUVD-2026-45580

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-64001

Vulnerability: CVE-2026-64001 in the Linux kernel’s ALSA: pcm: oss path. The bug arises in snd_pcm_oss_proc_write() where a newly allocated setup entry is linked into the OSS setup_list before the task-name is safely duplicated; if the task-name allocation fails, the error path frees the linked e...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-63987

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...