DEBIAN-CVE-2026-90257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

AZL-102251 CVE-2026-90257 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

SUSE CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

SUSE CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

SUSE CVE-2026-90017

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

SUSE CVE-2026-90018

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-93201 dm-pcache: validate seg_id fields from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

EUVD-2026-82309

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

EUVD-2026-82287

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93065 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates...

CVE-2026-93055 UDF symlink pathComponent header OOB read

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93055 UDF symlink pathComponent header OOB read

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-93055

CVE-2026-93055 affects the Linux kernel's UDF filesystem implementation. The vulnerability is an out-of-bounds (OOB) read in the handling of UDF symlinks: udf_symlink_filler() can pass a partial pathComponent header to udf_pc_to_char(), which then reads beyond the available input. The fix validat...

EUVD-2026-82165

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

EUVD-2026-82146

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...