Linux Kernel Security Vulnerabilities

The Linux kernel version 6.10 contains security vulnerabilities. These vulnerabilities stem from the use of bpfcryptoctxcreate, which reads reserved fields before comparing the sizes of params. This can lead to the kernel reading beyond the validated area when BPF programs pass shorter buffers...

Ryan C. Gordon’s smpeg buffer error vulnerability

Ryan C. Gordon’s MPEG.2.0.0 and earlier versions have a buffer error vulnerability. This vulnerability stems from the MPEGsystem::FillBuffer function, which handles special system header streams by performing heap out-of-bounds reads. An attacker can provide an MPEG file with the high-order bits ...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.10.28 to 5.11, 5.11.11 to 5.12, and 5.12 itself. These vulnerabilities stem from releasing a bpf program that is linked to trampoline without waiting for the RCU task timeout period. Preemptive tasks may call this program after it is...

SpatiaLite numerical error vulnerability

SpatiaLite 5.1.0 and earlier versions have a numerical error vulnerability. This vulnerability stems from integer overflows in the size checks for WKB points and vertices during the ParseWkbLine function and related parsers in ggwkb.c. This could lead to out-of-bounds reads. An attacker could...

Johannes Kuhlmann cgltf buffer error vulnerability

Johannes Kuhlmann’s cgltf versions prior to 1.15 contain a buffer error vulnerability. This vulnerability stems from the cgltfaccessorunpackfloats function, which advances the cursor based on the byteStride of the base bufferView when handling sparse values. This allows for heap out-of-bound...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains security vulnerabilities. These vulnerabilities stem from the possibility of the host controlling the length of the SGL segment, meaning that the SGL segment is too short. As a result, the nvmetpciipcfgetsglsegment function may read beyond its bounds,...

AbiWord wv buffer error vulnerability

AbiWord versions 1.2.9 and earlier have a buffer error vulnerability. This vulnerability stems from the wvGetSTSH function in stylesheet.c, which involves heap-based out-of-bounds read operations. Attackers can exploit this vulnerability by providing custom Word style sheets or.doc files containi...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the function pn533acr122isrxframevalid, which does not validate the frame-ccid.datalen value read from the USB response frame. Instead, it uses this value as an index for frame-data. Malicious or faulty devices can set...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.13 contains security vulnerabilities. These vulnerabilities arise from the s390/uv component, which allows only 85 items to be stored in the uvsecretlist array per page when there are more than 85 secrets in the system. The findsecretinpage function does not iterate ove...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.5 contains a security vulnerability. This vulnerability arises from the xskmapgenlookup function using BPFJMPIMM for 32-bit comparisons. As a result, the immediate numbers are symbol-extended to 64 bits, leading to out-of-bounds index access and reading of values beyond...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.24 has a security vulnerability. This vulnerability arises from the use of skb-len to verify the length of the skb in ieee80211monitorselectqueue. No checks are performed on the length of the linear data area. When AFPACKET sends large packets, accessing the 802.11...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the fact that hcisock does not verify the length of events before filtering them. When reading event codes and command operation codes, it does not check whether the skb is not empty or the length of the event. This may...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.32 has a security vulnerability. This vulnerability stems from L2CAP not verifying the frame length in the access control field and before the FCS. Short ERTM or stream mode frames may lead to out-of-bounds read accesses...

RTMPDump: Buffer Overflow Vulnerability in the librtmp Library

The librtmp version 2.6 and earlier have a buffer error vulnerability. This vulnerability stems from AMF3Decode ignoring failed AMF3 attribute decoding. Malicious RTMP servers or interrupters can send extremely large AMF3 strings, thereby destroying heap memory and leaking heap bytes when the...

CLSA-2026-1792246493 kernel: Fix of 31 CVEs

ipv4: validate checksumstart before completing checksum CVE-2026-99999 - fbdev: serialize mode sysfs access with lockfbinfo CVE-2026-80785 - powerpc/rtas: avoid device tree lookups in rtasosterm CVE-2022-50870 - svcrdma: Reject connection when transport allocation fails CVE-2026-89531 -...

CLSA-2026-1792245431 kernel: Fix of 31 CVEs

ipv4: validate checksumstart before completing checksum CVE-2026-99999 - fbdev: serialize mode sysfs access with lockfbinfo CVE-2026-80785 - powerpc/rtas: avoid device tree lookups in rtasosterm CVE-2022-50870 - svcrdma: Reject connection when transport allocation fails CVE-2026-89531 -...

kernel: Fix of 31 CVEs

ipv4: validate checksumstart before completing checksum CVE-2026-99999 - fbdev: serialize mode sysfs access with lockfbinfo CVE-2026-80785 - powerpc/rtas: avoid device tree lookups in rtasosterm CVE-2022-50870 - svcrdma: Reject connection when transport allocation fails CVE-2026-89531 -...

SUSE-SU-2026:24323-1 Security update for expat

This update for expat fixes the following issues: - CVE-2025-59375: denial of service resource consumption caused by processing malformed small documents bsc1249584. - CVE-2026-24515: NULL dereference CWE-476 due to function XMLExternalEntityParserCreate failing to copy the encoding handler data...

kernel: Fix of 69 CVEs

sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...

CLSA-2026-1791949745 kernel: Fix of 69 CVEs

sctp: fix errchunk memory leaks in INIT handling CVE-2026-72413 - ACPICA: Fix use-after-free in acpidsterminatecontrolmethod CVE-2026-97455 - ACPICA: Enhance buffer validation in acpiutwalkamlresources CVE-2026-97445 - Bluetooth: L2CAP: validate connectionless PSM length CVE-2026-97408 - wifi:...