Linux Distros Unpatched Vulnerability : CVE-2026-98169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct...

Linux Distros Unpatched Vulnerability : CVE-2026-98170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fixed an OOB read issue in the NCSICMDSENDCMD payload length The ncsisendcmdnl function takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header. However, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath6kl – Fix for OOB read from the firmware’ nummsg field in the TX complete handler The firmware-controlled nummsg field u8, 0-255 affects the loop in ath6klwmitxcompleteeventrx, without any validation against the buffer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: Fixed issues related to OOB access in ULE extension header tables. The ulemandatoryexthandlers and uleoptionalexthandlers tables in handleoneuleextension are declared with 255 elements valid indices 0-254. However...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed issues with WEP length underflow and OOB read during the OnAuth process. OnAuth contains two bugs in the shared-key authentication process. When the Privacy bit is set, rtwwepdecrypt is called without...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: eir: Fixed an issue with OOB reading in eirgetservicedata. eirgetservicedata processes advertising data for a Service Data field with a matching UUID. In case of a mismatch, it advances to the next field as follows:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read The udfsymlinkfiller function can access udfpctochar with a partially completed pathComponent header. It is necessary to validate that there is sufficient remaining input to complete the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the updatebeaconinfo function’s IE loop. The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 with each iteration, but it only checks that i...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8723bs: Fixed an issue where the OOB read was performed in the IE parsing loop during OnAssocRsp. The IE parsing loop in OnAssocRsp advances by pIE-length + 2 with each iteration, but it only checks for i length fr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys – Fixed the OOB read issue in pefiledigestpecontents. pefiledigestpecontents calculates the hash length of the trailing data as pelen - hashedbytes + certssize. A crafted PE could cause this subtraction to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rndishost: An overflow check was added in rndisrxfixup. An overflow check is added to ensure that dataOffset + dataLen + 8 does not exceed the maximum value, thereby preventing an OOB Out-of-Buffer read of the USB data buffer...

MiracleLinux 8 : kernel-4.18.0-553.167.1.el8_10 (AXSA:2026-1968:90)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1968:90 advisory. kernel: drm/amdgpu: Fix use-after-free race in VM acquire CVE-2026-43370 kernel: mac802154: llsec: add skbcowdata before in-place crypto...

AlmaLinux 10 : kernel (ALSA-2026:71233)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71233 advisory. kernel: block: zero non-PI portion of auto integrity buffer CVE-2026-23007 kernel: netfilter: ebtables SNAT target writes to shared memory pages during...

SUSE CVE-2026-98077

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

UBUNTU-CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

Linux Distros Unpatched Vulnerability : CVE-2026-104201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - radsecproxy - None Ubuntu Linux - GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption CVE-2026-104201 Note that Nessus relies o...

SUSE CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...