PT-2026-116714

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev get by name...

PT-2026-116823

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn bind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

PT-2026-116764

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata scsi set passthru sense fields trusts it...

PT-2026-116676

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap data rcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefo...

PT-2026-116704

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t rt: fix zero-address non-strict match out-of-bounds read rt mt6 check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6T RT FST MASK is requested. In the IP6T RT FST NSTRICT pat...

PT-2026-116754

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read dts node of clk get returns a clock with its reference count incremented, but read dts node only uses it to read the rate and never calls clk put. The clock is not stored anywhere, so the...

PT-2026-116700

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...

PT-2026-116718

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom wac pen serial enforce The 'wacom wac pen serial enforce' function may calculate and pass an invalid offset to hid field extract, resulting in memory reads at incorrect addresses -- possibly beyo...

PT-2026-116801

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-116921

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

PT-2026-116930

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment align size, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fra...

PT-2026-116751

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6 find hdr return an offset past the packet end ipv6 find hdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6 optlen returns up to 2048, and the skip is...

PT-2026-116613

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...

PT-2026-116612

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng read ordr that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a...

PT-2026-116624

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepng util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

Linux Distros Unpatched Vulnerability : CVE-2026-112058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid Jump...

Linux Distros Unpatched Vulnerability : CVE-2026-98726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1731431059)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1731431059 advisory. - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way...

PT-2026-116705

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena device init initializes the MMIO read mechanism with ena com mmio reg read request init, which allocates a coherent DMA buffer for MMIO read responses. The normal removal...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...