CVE-2026-92516

CVE-2026-92516 affects the Linux kernel's BPF subsystem . The bug is in the verifier's offset warning check: the case statement for BPF_RES_SPIN_LOCK incorrectly referenced the offset for BPF_SPIN_LOCK instead of res_spin_lock_off . The fix corrects this by checking the proper offset variable. Th...

CVE-2026-92516 bpf: Fix offset warn check for bpf_res_spin_lock

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-90314 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

EUVD-2026-81975

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90203 Squashfs: check block offset is not negative

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

CVE-2026-90203

CVE-2026-90203 is a Linux kernel vulnerability in the Squashfs filesystem driver. A negative block offset read from disk (e.g., the offset into a decompressed fragment block) causes squashfs_copy_data() to perform an out-of-bounds access . The fix checks whether the offset is negative and returns...

CVE-2026-24073

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size...

EUVD-2026-81321

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...

CVE-2026-24073 Out-of-bounds Write in Video

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size...

EUVD-2026-81320

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size...

PT-2026-94662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the remoteproc component due to the use of a signed offset in the rsc table for each entry function. The table-offseti value, provided as a u32 from...

CVE-2026-93045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-92516: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-90314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

PT-2026-94942

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the proc timens set offset function where the tv nsec field is not validated to be within the required range of 0, NSEC PER SEC-1 before being used in timespec64 add...

CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

DEBIAN-CVE-2026-89906

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

AZL-101568 CVE-2026-89906 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

EUVD-2026-80554

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89954 mtd: afs: validate v2 image info bounds

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...