PT-2026-116795

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFC LLCP component where the functions nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null-terminated strings to pr debug using the %s format specifier...

CVE-2026-98602: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

CVE-2026-112056: Out-of-bounds Read

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

PT-2026-116636

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

CVE-2026-112057: Out-of-bounds Read

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

CVE-2026-98810: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

PT-2026-116680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur when the hci send to sock function invokes a filter before the hci event packet function validates the event header. The is filtered packet function reads...

CVE-2026-112053: Out-of-bounds Read

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

PT-2026-128375

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

CVE-2026-98687: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

PT-2026-116909

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A domain reference leak occurs in the thunderbolt component when a DPRX read is canceled. The function tb tunnel one dp acquires a domain reference that is only released after tb dp tunn...

PT-2026-116853

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCSI zoned block device ZBC implementation. The function sd zbc read zones calculates the number of zones using 64-bit arithmetic but stores the result in the nr...

CVE-2026-98575: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

PT-2026-128350

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav describe title chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts ttn...

PT-2026-116797

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the st21nfca NFC driver where the ISO15693 inventory helper fails to verify the existence of a two-byte prefix before removing it. Subsequently, it accepts a one-byte...

PT-2026-116764

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the ata scsi set passthru sense fields function improperly trusts the additional length byte sb7 from a device's REQUEST SENSE reply during a...

PT-2026-116612

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng read ordr that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a...

CVE-2026-112061: Out-of-bounds Read

librtmp RTMPDump through 2.6 contains a heap out-of-bounds read vulnerability in AMFPropDecode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer th...

PT-2026-128458

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment align size, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fra...

CVE-2026-98611: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...