CVE-2026-98486: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

PT-2026-116877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The firmware parser in the aw96103 proximity sensor driver reads a length from the binary header to process six-byte register/value entries. A truncated firmware image can cause the pars...

PT-2026-116830

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf crypto ctx create kfunc where the function reads the reserved0 and reserved1 fields of the params structure before verifying if the buffer size params sz is...

PT-2026-128586

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-128426

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond resched in inet csk listen stop under BPF context bpf sock destroy runs from the tcp iterator, under rcu read lock. If the sock is a listener that still has children in its accept queue, tcp abort ends up in inet c...

PT-2026-116794

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the pn533 acr122 is rx frame valid function. The datalen variable within frame-ccid is read directly from the USB response frame and used as an index into...

PT-2026-128407

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk map gen lookup xsk map gen lookup loads a u32 key and compares it with max entries using BPF JMP IMM. BPF immediates are sign-extended to 64 bits, so a max entries value of 0x80000000 or higher...

PT-2026-128478

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb xdp properties request allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can...

PT-2026-116609

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read text, read blob, COPY...

PT-2026-116754

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A clock reference leak exists in the fsl/fman component. The read dts node function calls of clk get, which increments the reference count of a clock, but the function fails to call clk...

CVE-2026-98843: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

PT-2026-116714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the ARP ioctl. The system copies a user-provided struct arpreq into a stack object, but the arp dev field may lack a NUL terminator. When this input is...

CVE-2026-98631: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

PT-2026-116842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the nvkm clk ustate update function. The issue occurs when the list for each entry loop exits without encountering a break, leaving the pstate pointer...

CVE-2026-98658: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

PT-2026-128443

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata scsi set passthru sense fields trusts it...

CVE-2026-98830: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-112019: Out-of-bounds Read

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...

PT-2026-116676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the Bluetooth L2CAP implementation. The l2cap data rcv function unpacks a two-byte or four-byte control field without verifying its presence, which can...

PT-2026-116644

librtmp RTMPDump through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer...