CLSA-2026-1779987841 kernel: Fix of 110 CVEs

smb: client: reject userspace cifs.spnego descriptions - mlxsw: spectrumacltcam: Fix possible use-after-free during rehash CVE-2024-35854 - cifs: Fix memory leak when build ntlmssp negotiate blob failed CVE-2022-50372 - scsi: lpfc: Check kzalloc in lpfcsli4cgnparamsread CVE-2023-53038 -...

CLSA-2026-1792547230 ImageMagick: Fix of 3 CVEs

CVE-2026-109259: fix uninitialized memory read in the TGA decoder - CVE-2026-106578: fix invalid memory free in the MVG decoder on undersized primitive extent...

DEBIAN-CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...

dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92823

A flaw exists in libmodulemd affecting builds with rpmio support enabled. The vulnerability occurs because a custom read handler fails to enforce a cumulative decompressed-size limit when parsing compressed modulemd YAML files. This allows an attacker to provide a highly compressible file, trigge...

CVE-2026-92823 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via MossAudioProcessingInfo.gethfprocessor in MOSS-Audio model serving, which caches a...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unvalidated per-request mmprocessorkwargs forwarded through the multimodal processing...

CLSA-2026-1792547456 ImageMagick: Fix of 3 CVEs

CVE-2026-109259: fix uninitialized memory read in the TGA decoder - CVE-2026-106578: fix invalid memory free in the MVG decoder on undersized primitive extent...

CVE-2026-98696

A flaw was found in the Linux kernel's USB serial subsystem. A local user with administrative privileges could exploit this flaw to cause a Denial of Service DoS or memory corruption. During the unloading of a USB serial driver module, drivers are deregistered in an incorrect sequence, allowing...

CVE-2026-98639

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed to shared memory. Consequently, the supervisor interface or...

CVE-2026-98840

A flaw was found in the Linux kernel's virtual console screen driver. A race condition between virtual console write operations and console deallocation can cause the kernel to access previously freed memory, resulting in a use-after-free vulnerability. A local user could exploit this flaw to cau...

CVE-2026-98830

A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base MIB queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized...

CVE-2026-98800

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed execution. A local user can exploit this race condition to...

CVE-2026-114103

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114052

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...

DEBIAN-CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

DEBIAN-CVE-2026-114044

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized...

DEBIAN-CVE-2026-114041

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

CVE-2026-114041

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in clientclipresentgatewaymessage that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...