CVE-2026-90089

This Linux kernel vulnerability affects the btnxpuart Bluetooth driver (NXP UART-based controllers). The function nxp_process_fw_dump() reads seq_num and buf_len from an 8-byte struct nxp_fw_dump_hdr at the start of the ACL payload without verifying that the payload is at least 8 bytes long. Sinc...

CVE-2026-90090

This CVE affects the Linux kernel Bluetooth btmtksdio driver. In the TX path, btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes but passes the raw SKB buffer to sdio_writesb(). Since only skb->len bytes hold actual packet data, the host controller reads up t...

CVE-2026-90089 Bluetooth: btnxpuart: Validate the FW dump header length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

CVE-2026-90090 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

CVE-2026-90082 net: mana: Cap MSI-X vectors to the device MSI-X table size

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

CVE-2026-90068 ASoC: dapm: Fix off-by-one check on the second enum channel

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-90068

CVE-2026-90068 is an off-by-one bounds check in the Linux kernel's ASoC dapm (Digital Audio Processing Module) subsystem. The function snd_soc_dapm_put_enum_double() rejects item[0] when it reaches e->items but permits item[1] to equal that value, causing snd_soc_enum_item_to_val() to read one...

EUVD-2026-81929

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-90068 ASoC: dapm: Fix off-by-one check on the second enum channel

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

GHSA-X5QG-8PQ6-39H6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

EUVD-2026-81682

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-93013

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints. The root cause is missing path validation on the file_path parameter, which allows authenticated attackers to supply absolute file paths and read arbitrar...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

A flaw was found in GStreamer gst-plugins-good avidemux. In gstavidemuxriffparsevprp, the number of available gstriffvprpvideofielddesc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgstriffvprpvideofielddesc. This ca...

Important: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

A flaw was found in GStreamer gst-plugins-good avidemux. In gstavidemuxriffparsevprp, the number of available gstriffvprpvideofielddesc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgstriffvprpvideofielddesc. This ca...

Important: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...