CVE-2026-81017: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

PT-2026-90079

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmf sdio read control The memory allocated for buf is not freed in some of the error paths in brcmf sdio read control. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-90159

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst if get perf level mask and isst if get base freq mask use the user-provided level as an index into perf levels via read pp level info and read bf level info, but neither...

CVE-2026-89571: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...

PT-2026-90346

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data offset bound in is valid oplock break Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smb hdr" changed the quantity this bound is measured against. It used to be srv-total read minus the...

ROS-20260911-73-0115

The vulnerability of Chromecast web browsers Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260911-73-0099

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to reading data from buffer areas beyond their permitted limits. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0139

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260911-73-0078

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to reading data beyond the permitted range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

ROS-20260911-73-0196

The vulnerability of Google Chrome’s WebGPU component relates to reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through a specially created HTML page...

ROS-20260911-73-0226

The vulnerability in Chromium is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260911-73-0227

The vulnerability in Chromium is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260911-73-0026

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

PT-2026-90347

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

PT-2026-90208

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2 validate dx leaf and ocfs2 validate dx root check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither...

PT-2026-90475

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleak scan scans every task stack under one rcu read lock with no reschedule point, which can trip...

PT-2026-90249

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

PT-2026-90348

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse buf ptr reparse buf ptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparse data buffer u8 io + off; len =...

CVE-2026-89542: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...