CVE-2026-112060: Out-of-bounds Write

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-98643: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98512: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

PT-2026-117029

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read exists in the mac80211 wifi component. The function ieee80211 monitor select queue validates the socket buffer skb length using the skb-len variable before...

PT-2026-116751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 implementation where the ipv6 find hdr function fails to verify if the calculated offset of an extension header chain exceeds the total packet length skb-len...

CVE-2026-98495: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

PT-2026-116701

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfc llcp recv hdlc function where the sequence byte skb-data2 is read via nfc llcp ns and nfc llcp nr before a proper length check is performed. Because the receiv...

CVE-2026-98485: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

PT-2026-116731

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free flaw exists in the drm/nouveau component. The nouveau sched destroy function calls nouveau sched fini, which invokes drm sched fini&sched-base, and subsequently releases...

PT-2026-128601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel hw error The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s"...

PT-2026-128469

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533 acr122 is rx frame valid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field ...

CVE-2026-98726: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

PT-2026-116635

Name of the Vulnerable Software and Affected Versions libspatialite versions prior to 5.1.1 Description An integer overflow exists in the WKB point and vertex count size guard within the ParseWkbLine function and related parsers in gg wkb.c. This flaw allows out-of-bounds reads when processing a...

PT-2026-116705

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ena network driver during a probe failure. The ena device init function uses ena com mmio reg read request init to allocate a coherent DMA buffer for MMIO rea...

CVE-2026-98839: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

PT-2026-116831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the catc rx done function where it fails to properly bound the RX packet length when processing a multi-packet URB USB Request Block. The function compares the packet...

PT-2026-116850

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xsk map gen lookup function where a u32 key is compared with max entries using BPF JMP IMM. Because BPF immediates are sign-extended to 64 bits, a max entries valu...

PT-2026-128483

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

PT-2026-128383

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...