CVE-2026-90089: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

PT-2026-94437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth btnxpuart component where the nxp process fw dump function reads seq num and buf len from a nxp fw dump hdr structure without verifying if the ACL payloa...

CVE-2026-90261: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

PT-2026-94569

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFC NCI component where the functions nci core init rsp packet v1 and nci core init rsp packet v2 parse the CORE INIT RSP packet without verifying if the socket...

PT-2026-95118

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description An out of bounds read exists in the DataTransfer component. This allows a local attacker, using social engineering, to read memory outside the sandbox through a local program. An out of...

PT-2026-94761

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc4 Description An issue exists in the IB/isert component where the system fails to compare the actual bytes received in the login buffer against the length declared in the login Protocol Data Unit PDU Basi...

Unity Linux 20.1070-8ae / 20.1070e Security Update: qt5-qtbase (UTSA-2026-109808)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109808 advisory. An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminat...

CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90263: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

PT-2026-94997

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where the system fails to validate cache segment IDs retrieved from persistent memory metadata. Specifically, the functions cache pos decode,...

PT-2026-94611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the btrfs filesystem, write operations including Access Control Lists ACL and extended attributes xattr should be denied when the read-only property is set to true. However, ACLs can...

CVE-2026-93201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-73638: Out-of-bounds Read

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90414: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone hands each received PDU to the opcode handlers without ever looking at wc-bytelen, the number of bytes the HCA actually placed in the receive descriptor. T...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109818)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109818 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c...

Unity Linux 20.1070-8ae / 20.1070e Security Update: sssd (UTSA-2026-109823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109823 advisory. A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before...

PT-2026-94859

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack over-read exists in the debug output helpers of the host1x GPU driver. The functions host1x debug output and host1x debug cont utilize vsnprintf, which returns the total length t...

PT-2026-94863

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iwlwifi driver where the loop counter count in the iwl fwrt dump error logs function is declared as a u8 8-bit unsigned integer while the num pc variable is a u32...

PT-2026-94755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath11k wmi process csa switch count event function. This happens because there is no policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...