CVE-2026-72156 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

EUVD-2026-58914

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

CVE-2026-72156 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

CVE-2026-72156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero headersize OOB read in mpfopsparseheader mpfopsparseheader reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the expression buf + headersize - 1 reads one byte...

CVE-2026-72227: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

CVE-2026-74346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

PT-2026-72782

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the RDMA/irdma component during Completion Queue CQ memory registration. The issue occurs because the cqmr-split field, which tracks the IRDMA FEATURE CQ...

CVE-2026-74410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

CVE-2026-74340: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

SUSE CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

OESA-2026-3383 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer...

OESA-2026-3380 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer...

CVE-2026-52067

rxip truncated DHCP options sizet underflow OOB read...

CVE-2026-52072

mgtlsclientrecvhello sizet underflow in extlen bounds check / mgtlsclientrecvhello extlen fixed-offset OOB read...

CVE-2026-52070

rxndpns ICMPv6 NS minimum length insufficient -- OOB read...

CVE-2026-52056

skipchunk off-by-one OOB read in chunked HTTP CRLF check...

CVE-2026-52065

mgtlsclientrecvhello keyshare extension OOB read...

CVE-2026-52051

mgtlsserverrecvhello sessionidlen OOB read...

CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433

GStreamer gst-plugins-good (avidemux) contains a vulnerability in the AVI strd metadata path for FUJIFILM metadata parsing. In gst_avi_demux_parse_strd(), a remaining-length counter is decremented by fixed offsets (98 and 10 bytes) without checking data sufficiency, causing underflow for crafted ...