CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

CVE-2026-74641 ALSA: usx2y: bound the hwdep mmap fault offset

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

EUVD-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

CVE-2026-74597

CVE-2026-74597 is a memory corruption vulnerability in the Linux kernel's ip6_tunnel (IPv6-in-IPv6 tunneling) subsystem. In ip6ip6_err(), a cloned outer IPv6 ICMP error skb retains the outer packet's inet6_skb_parm in skb->cb after being pulled to the quoted inner packet. If the outer packet c...

CVE-2026-74597 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...

PT-2026-79602

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: clear skb2-cb in ip6ip6 err ip6ip6 err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6 send. The clone still carries the outer packet's inet6 skb parm...

CVE-2026-43820

A flaw was found in swift-nio-ssl. This vulnerability arises from the improper handling of Subject Alternative Names SANs within SSL certificates. When processing SANs that are not backed by an ASN1STRING, the system attempts to access memory outside of its allocated buffer, leading to an...

CVE-2026-74580

A flaw was found in the Linux kernel's vhost subsystem. A local attacker could exploit this vulnerability by reconfiguring a virtual ring vring using specific ioctl commands while a device Input/Output Memory Management Unit IOTLB is attached. This improper handling of the vring metadata cache ca...

EUVD-2026-64002

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-74580

CVE-2026-74580 is a vulnerability in the Linux kernel vhost subsystem. The vq->meta_iotlb[] cache, which stores IOTLB mappings for vring metadata regions, is not invalidated when VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM reconfigures a live vring. This causes iotlb_access_ok() to return a st...

CVE-2026-74524

A flaw was found in the Linux kernel. When performing memory hot-remove operations on systems using RISC-V architecture, an out-of-bounds page-table walk can occur. This issue arises because the system attempts to access memory outside of its designated boundaries, potentially leading to a kernel...

CVE-2026-74451

A flaw was found in the drm/panthor component of the Linux kernel. The ifacefwtocpuaddr function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit MCU virtual address fits entirely within the shared memory...

PT-2026-79294

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

PT-2026-79401

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-meta iotlb caches the vhost iotlb map that backs each vring metadata region, and iotlb access ok returns early on a cache hit, taking the hit as proof that the...

CVE-2026-64719

A flaw was found in WebKitGTK. Processing malicious web content can cause an out-of-bounds access issue due to improper bounds checking and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-74312

A flaw was found in the Linux kernel's vhost/vdpa subsystem. Improper validation of the virtqueue index in the vhostvdpammap and vhostvdpafault functions allows an out-of-range index to be used. This can lead to an out-of-bounds memory access in driver-specific callbacks, potentially causing...

CVE-2026-74275

A flaw was found in the Linux kernel. A vulnerability exists in the cxlcancelautoattach function where an invalid negative index can be used to access an array. This out-of-bounds memory access could allow a local attacker to cause system instability or a denial of service DoS...

CVE-2026-20319

creationtimestamp| type| source ---|---|--- 2026-08-20 14:25:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh6z3l4k26...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-72488

A flaw was found in the Linux kernel's soundwire component. An out-of-bounds memory access can occur within the sdwaddelementgroupcount function due to an incorrect loop condition. This error allows the system to attempt to access memory beyond its allocated buffer. Such an issue could lead to...