CVE-2026-74694 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74694 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74694

CVE-2026-74694 is a heap out-of-bounds read in the Linux kernel's net/ncsi subsystem. The function ncsi_send_cmd_nl() trusts the attacker-controlled ncsi_pkt_hdr.length field from the in-band packet header without cross-checking it against the actual readable size of the NCSI_ATTR_DATA netlink at...

EUVD-2026-64588

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

PT-2026-79645

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcp meter ctl get fcp ioctl set meter map bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.map size 255 || map.meter slots 255 return -EINVAL; and passes it to fcp...

Linux Distros Unpatched Vulnerability : CVE-2026-74682

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter:...

PT-2026-79699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the NCSI Network Controller Sideband Interface implementation. The function ncsi send cmd nl uses the length field from the ncsi pkt hdr structure to...

Linux Distros Unpatched Vulnerability : CVE-2026-74694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length fiel...

CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

USN-8668-1: Linux kernel (GCP) vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

EUVD-2026-64008

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

AZL-96992 CVE-2026-74580 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-45201

This vulnerability affects the Imagination Technologies GPU DDK , specifically the PhysmemNewRamBackedPMR function. A non-privileged user can issue improper GPU system calls with an invalid log2 page size during physical page allocation, bypassing validation and causing out-of-bounds read and/or ...

AZL-97413 CVE-2026-55894 affecting package rust for versions less than 1.96.1-1

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

CVE-2026-53587 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

CVE-2026-53587 libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

OESA-2026-3451 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer...