CVE-2026-64139

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in setposixaclentriesdacl on overflow Commit 299f962c0b02 "ksmbd: use checkaddoverflow to prevent u16 DACL size overflow" added checkaddoverflow guards that break out of the ACE-building loops in...

CVE-2026-64139

CVE-2026-64139 : In the Linux kernel ksmbd path, a memory-leak exists in set_posix_acl_entries_dacl() on overflow. The loop allocates a struct smb_sid with kmalloc_obj() each iteration and relies on per-iteration kfree() at loop end. Introduced break paths skip these frees, causing the sid buffer...

CVE-2026-64139 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in setposixaclentriesdacl on overflow Commit 299f962c0b02 "ksmbd: use checkaddoverflow to prevent u16 DACL size overflow" added checkaddoverflow guards that break out of the ACE-building loops in...

EUVD-2026-45647

In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmountmntidmap statmountmntidmap writes one mapping with seqprintf and then manually advances seq-count to include the NUL separator. If seqprintf overflows, seqsetoverflow sets...

CVE-2026-64074

The CVE-2026-64074 issue affects the Linux kernel, specifically a slab out-of-bounds write in statmount_mnt_idmap inside fs/statmount. When building a string with seq_printf(), an overflow may occur and manual increment of seq->count can push it to size+1, causing seq_has_overflowed() to miss ...

CVE-2026-64074 fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap

In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmountmntidmap statmountmntidmap writes one mapping with seqprintf and then manually advances seq-count to include the NUL separator. If seqprintf overflows, seqsetoverflow sets...

CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-63893 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...

EUVD-2026-45666

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...

CVE-2026-63893

The connected documents describe a Linux kernel vulnerability in thunderbolt property parsing: a wrap of the 32-bit sum (entry->value + entry->length) allows an attacker-controlled offset to read memory beyond the property block. The root cause is not validating the sum with overflow checks...

PT-2026-61368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qaic gem object mmap function where the call to remap pfn range is susceptible to mapping beyond the Virtual Memory Area VMA if the Buffer Object BO is too large...

SUSE CVE-2026-53329

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use kreallocarray in dalvectorreserve Why & How dalvectorreserve computes the allocation size as "capacity vector-structsize" using uint32t arithmetic, which can silently wrap to a small value on overflow. This...

UBUNTU-CVE-2026-53329

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use kreallocarray in dalvectorreserve Why & How dalvectorreserve computes the allocation size as "capacity vector-structsize" using uint32t arithmetic, which can silently wrap to a small value on overflow. This...

CVE-2026-53329

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use kreallocarray in dalvectorreserve Why & How dalvectorreserve computes the allocation size as "capacity vector-structsize" using uint32t arithmetic, which can silently wrap to a small value on overflow. This...

CVE-2026-53329

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use kreallocarray in dalvectorreserve Why & How dalvectorreserve computes the allocation size as "capacity vector-structsize" using uint32t arithmetic, which can silently wrap to a small value on overflow. This...

EUVD-2026-40963

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use kreallocarray in dalvectorreserve Why & How dalvectorreserve computes the allocation size as "capacity vector-structsize" using uint32t arithmetic, which can silently wrap to a small value on overflow. This...

SUSE CVE-2026-53059

In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to regioncount overflow The local variable regioncount in createlogcontext is declared as unsigned int 32-bit, but dmsectordivup returns sectort 64-bit. When a device-mapper target has a...

TencentOS Server 3: kernel (TSSA-2026:0544)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0544 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

SUSE CVE-2026-53021

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbcexecuteunmap checks LBA + range does not exceed the device capacity, but does not guard against LBA + range wrapping around on 64-bit overflow. Add an overflow che...

SUSE CVE-2026-53203

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS getinfoioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size...