CVE-2026-25288

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

EUVD-2026-52736

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...

EUVD-2026-52728

Memory corruption while processing a packet with a size close to the maximum allowed value...

CVE-2026-21366

CVE-2026-21366 is described as memory corruption while processing a packet with a size close to the maximum allowed value. The initial listing and connected records corroborate a memory corruption issue, but no concrete affected product/vendor/version details are provided in the supplied document...

CVE-2026-21366 Integer Overflow or Wraparound in Data Network Stack & Connectivity

Memory corruption while processing a packet with a size close to the maximum allowed value...

SUSE CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

EUVD-2026-49039

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64527

The CVE-2026-64527 entry describes a Linux kernel issue in drm/hyperv where VMBus packet size is not validated in the receive callback. hyperv_receive_sub() dispatches on msg->vid_hdr.type without knowing the host-written length, leading to a potential read of stale data when copying from hv-&...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64270

CVE-2026-64270 affects the Linux kernel where mms114_interrupt() reads I2C touch data into a fixed-size stack buffer without properly bounding the reported packet_size. A malicious or faulty device/controller can report packet_size up to 255, allowing a write past the end of touch[] on the IRQ th...

EUVD-2026-48982

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

CVE-2026-64270 Input: mms114 - reject an oversized device packet size

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

CVE-2026-64270 Input: mms114 - reject an oversized device packet size

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

PT-2026-64491

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114 interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114 touch touchMMS114 MAX TOUCH; which holds MMS114 MAX TOUCH 10...

PT-2026-64758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where the hyperv receive sub function processes VMBus packets without verifying the actual number of bytes written by the host into hv-recv bu...

CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

EUVD-2026-48371

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

SUSE CVE-2026-59843

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service...

SUSE CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...