CVE-2026-81014

CVE-2026-81014 is a heap out-of-bounds read in the Linux kernel's platform/x86: hp-bioscfg driver, affecting the sk_store() and kek_store() sysfs write handlers. Both functions strip a trailing newline from user input and allocate a key buffer of size length (one byte shorter), but then pass the ...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-80972 ALSA: aloop: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

PT-2026-90103

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the ALSA 6fire driver where the usb6fire comm receiver handler function forwards MIDI events using a length byte provided by the device without proper bounds checking. The...

CVE-2026-89691: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89700: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...

PT-2026-90416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB read occurs in the Linux kernel when a caller with CAP NET ADMIN privileges sends a 16-byte NFSD A SOCK ADDR with sa family set to AF INET6. This is possible because...

PT-2026-90349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the coalesce t2 function computes data pointers using server-supplied DataOffset fields without validating them against buffer bounds. A small...

CVE-2026-89583: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

PT-2026-90092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where geometry fields from on-disk cache info are not properly validated. The cache segs init function iterates based on the n segs value to...

PT-2026-90144

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A heap out-of-bounds read exists in the hp-bioscfg module. The functions sk store and kek store strip a trailing newline from a sysfs write to determine the length for buffer allocation via...

PT-2026-90344

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the picolcd debug eeprom read function where it trusts a length byte provided by a device in its REPORT EE DATA reply. The function fails to verify this length against...

PT-2026-96449

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...

CVE-2026-81013: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-89633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

PT-2026-96479

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-90258

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function reads header fields before validating that the token is at least 16 bytes long. This can lead to out-of-boun...

PT-2026-96498

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...