CVE-2026-99153

The Linux kernel contains a vulnerability in the libiscsi component where it fails to properly validate the ITT (iSCSI Task Tag) reflected in a Reject PDU . Specifically, the iscsi_handle_reject() function takes the ITT directly from the rejected header without sufficient validation. An attacker-...

PT-2026-128145

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsi complete pdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSI OP LOGOUT RSP: case ISCSI OP LOGIN RS...

PT-2026-128147

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse pdu itt A transport that implements parse pdu itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmds max i and cmds m...

CVE-2026-99153: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a…

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

Server Technology PRO3X Rack PDU - port_mux Listener Program Override to Root Co — Detect

Fingerprint / reachability check for Server Technology PRO3X Rack PDU - portmux Listener Program Override to Root Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Server Technology PRO3X Rack PDU - portmux Listener Program Override to Root Command Execution""" from...

Opengear NGCS Firmware 25.11.8 — PDU `name` Command Injection (Authenticated Adm — Detect

Fingerprint / reachability check for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root R"""...

CVE-2026-89973

A flaw was found in the Linux kernel's nvme-tcp component. A malicious or misconfigured NVMe controller can send a Controller to Host Data Protocol Data Unit C2HData PDU in response to a write command, which is not properly validated for data direction. This can trigger a kernel warning, leading ...

CVE-2026-98960

The Linux kernel 's btrfs filesystem contains a vulnerability where btrfs_uring_encoded_data is leaked if the request is cancelled or the ring exits before reissue. This occurs because the kernel returns -EAGAIN while leaving the encoded data in the command PDU, and io_uring does not free driver ...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-114042

A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects...

CVE-2026-114042

FreeRDP 3.32.0 is vulnerable to a use-after-free flaw in the drdynvc channel . The issue occurs because the software frees a pool-owned stream using the owned-stream deallocator when the totalLength is smaller than the chunk size. A malicious RDP server can exploit this by sending a single well-f...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

CVE-2026-114042 FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash th...

PT-2026-120170

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX MAP SURFACE TO WINDOW PDU with oversized...

SUSE CVE-2026-98479

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479

A flaw was found in the Linux kernel's iSCSI TCP subsystem. A malicious or compromised iSCSI storage server can cause memory corruption and data integrity loss on a connected client by sending an unexpected Data-In Protocol Data Unit PDU in response to a write command. Because the kernel fails to...

CVE-2026-90413

A flaw was found in the Linux kernel's IB/isert component. A remote attacker can exploit this vulnerability by sending a specially crafted login Protocol Data Unit PDU that declares a larger data segment length than the actual data received. This discrepancy causes an out-of-bounds read during...

Linux Distros Unpatched Vulnerability : CVE-2026-98479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segme...

CVE-2026-98482

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...