EUVD-2026-76613

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89666

CVE-2026-89666 affects the Linux kernel's nfsd (NFS server daemon). A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD carrying an atime or mtime whose nseconds field is out of range —it decodes as a valid uint32 but is not a valid timespec64. Nothing in the setattr path clamps ...

EUVD-2026-76577

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89640

CVE-2026-89640 is an integer underflow in the Linux kernel's CIFS filesystem driver, specifically in cifs_remap_file_range() when performing a remap with len == 0 (clone to EOF). If the offset exceeds the source file size, the computed length becomes a negative loff_t , corrupting the ByteCount i...

CVE-2026-89600

CVE-2026-89600 is a use-after-free vulnerability in the Linux kernel's fanotify subsystem . The root cause: fsnotify_pre_content() builds a file_range on the triggering task's stack, and fanotify_alloc_perm_event() stores a pointer to range.pos in a heap-allocated permission event. If a signal in...

CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

golang.org/x/image/bmp: golang: golang.org/x/image/bmp: Denial of Service via out-of-range palette index in BMP decoding

A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP Bitmap file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial ...

CVE-2026-78126

CVE-2026-78126 affects strongSwan (an IKE/IPsec suite), versions 4.1.10 through 6.0.7 . The vulnerability is a NULL-pointer dereference in the eap-aka plugin triggered when processing an unexpected AKA-Synchronization-Failure message, which can result in a crash (denial of service). The CVSS 3.1 ...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory. Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST...

PT-2026-90382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the kernel fails to properly validate the nseconds field in NFSv3 SETATTR and create operations CREATE, MKDIR, SYMLINK, or MKNOD. A client can...

CVE-2026-89666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

CVE-2026-89721: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

PT-2026-90437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rockchip-samsung-dcphy PHY driver where the max register is incorrectly defined as 0x10000. Since the PHY register block is 64KB with a register stride of 4, the...

PT-2026-90316

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fanotify component. The fsnotify pre content function creates a file range on the triggering task's stack, and fanotify alloc perm event saves a...

PT-2026-96405

In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff t underflow in cifs remap file range when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = src inode-i size - off; If off i size, this is a negative loff t, corrupting the ByteCount i...

PT-2026-90443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the KVM arm64 GICv2 implementation, the vgic v2 deactivate function passes an INTID written by a guest to GICV DIR directly to vgic get vcpu irq. The system incorrectly treats a faile...

PT-2026-96512

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...