1568 matches found
CVE-2026-89583: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...
PT-2026-96482
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir get service data eir get service data walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eir len -= dlen; eir get data reports dle...
PT-2026-90092
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where geometry fields from on-disk cache info are not properly validated. The cache segs init function iterates based on the n segs value to...
PT-2026-90144
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A heap out-of-bounds read exists in the hp-bioscfg module. The functions sk store and kek store strip a trailing newline from a sysfs write to determine the length for buffer allocation via...
CVE-2026-89633: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...
PT-2026-96449
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate password input computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first...
CVE-2026-81013: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...
CVE-2026-89542: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...
PT-2026-96498
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...
PT-2026-90258
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function reads header fields before validating that the token is at least 16 bytes long. This can lead to out-of-boun...
CVE-2026-89700: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...
CVE-2026-81014: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...
PT-2026-90344
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the picolcd debug eeprom read function where it trusts a length byte provided by a device in its REPORT EE DATA reply. The function fails to verify this length against...
PT-2026-90416
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB read occurs in the Linux kernel when a caller with CAP NET ADMIN privileges sends a 16-byte NFSD A SOCK ADDR with sa family set to AF INET6. This is possible because...
CVE-2026-89691: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...
PT-2026-90103
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the ALSA 6fire driver where the usb6fire comm receiver handler function forwards MIDI events using a length byte provided by the device without proper bounds checking. The...
CVE-2026-42806
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI C-driver in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata bme69x.c. The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer setval...
CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...
