CVE-2026-89542

CVE-2026-89542 is a CRITICAL (CVSS 9.8) vulnerability in the Linux kernel's SUNRPC subsystem, specifically in the gss_krb5_unwrap_v2() function. When processing GSS-KRB5 tokens, the function reads header fields at fixed offsets before validating that the token is at least 16 bytes long, causing o...

CVE-2026-89541

A u32 integer overflow in the Linux kernel's SUNRPC component, specifically in gss_unwrap_resp_priv(), allows a malicious krb5p NFS server to send a crafted RPCSEC_GSS reply that bypasses the opaque-length bound check. When opaque_len is near 0xffffffff, the sum offset + opaque_len wraps, passing...

EUVD-2026-76401

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

CVE-2026-89495

CVE-2026-89495 affects the OCFS2/DLM (o2dlm) subsystem in the Linux kernel . The migration and recovery message handlers trust peer-supplied u8 length fields (namelen, lockname_len, num_locks) without bounding them before passing them to memcpy, resulting in a heap out-of-bounds write of up to ~2...

EUVD-2026-76400

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

EUVD-2026-76349

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-81014 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

CVE-2026-81014 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

CVE-2026-81014

CVE-2026-81014 is a heap out-of-bounds read in the Linux kernel's platform/x86: hp-bioscfg driver, affecting the sk_store() and kek_store() sysfs write handlers. Both functions strip a trailing newline from user input and allocate a key buffer of size length (one byte shorter), but then pass the ...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-80972 ALSA: aloop: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

EUVD-2026-76292

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

CVE-2026-80965 ALSA: serial-u16550: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – WebAssembly Linear Memory OOB via Table Index Confusion Overview A WebAssembly module uses an imported function with no bounds check on an array index. An attacker can supply an out-of-bounds index to read or write outside the linear memory, potentially leaking host secrets or...

EUVD-2026-75905

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...