CVE-2026-98479: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98482: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

PT-2026-116698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libiscsi tcp component where the iscsi tcp hdr dissect function fails to verify the data direction of a Data-In PDU Protocol Data Unit. When a target responds to a...

CVE-2026-68906

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

EUVD-2026-102912

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906

The libIEC61850 open-source implementation of IEC 61850 protocols is vulnerable to an infinite loop and out-of-bounds read in the parseUserInformation function located in src/mms/iso_acse/acse.c. The root cause is a failure to properly validate the negative bufPos returned by BerDecoder_decodeLen...

CVE-2026-90414

A flaw was found in the Linux kernel's IB/isert module. A remote attacker, after successful login, could send a specially crafted data packet PDU with a declared length exceeding the actual received data. This could lead to an out-of-bounds read of the receive buffer, potentially causing a system...

PT-2026-115645

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder decodeLength...

PT-2026-115384

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An uncontrolled resource consumption issue exists in the parse nla mode pdu function. Unauthenticated attackers can exhaust server memory by completing TLS and streaming bytes that do not begin...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability stems from the parseUserInformation function, which checks if len is zero before verifying the returned negative bufPos. As a result, errors are ignored, and the buffer-1 is read, leading to...

Astra Linux – Vulnerability in freerdp3

Versions of FreeRDP prior to 3.31.0 contain a heap-based buffer overflow issue in the negosendnegotiationrequest function, when processing Server Redirection PDU messages with LoadBalanceInfo fields controlled by an attacker. A malicious RDP server can trigger this overflow by sending a field of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, division by zero occurred in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign was 0, resulting in a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % blocksize, where blocksize =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: checks the data direction of a C2HData PDU The nvmetcphandlec2hdata function finds the request by command id and checks that it has a payload. However, it does not check that the command actually requested data to be...

Astra Linux – vulnerability in xrdp

xrdp is an open source RDP server. Versions up to and including 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue arises when memory is accessed before verifying the remaining buffer length. A remote, unauthenticated attacker can exploit this...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fixed a kernel panic that occurs when the host sends an invalid H2C PDU length. If the host sends an H2CData command with an invalid DATAL value, the kernel may crash in the nvmettcpbuildpduiovec function. The...