UBUNTU-CVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-64181

In the Linux kernel, the following vulnerability has been resolved: m...

CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-64048

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-64050

In the Linux kernel, the following vulnerability has been resolved: d...

CVE-2026-64062

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-63977

In the Linux kernel, the following vulnerability has been resolved: d...

CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: b...

CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-63888

In the Linux kernel, the following vulnerability has been resolved: s...

CVE-2026-64066

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-64052

In the Linux kernel, the following vulnerability has been resolved: b...

CVE-2026-53367

In the Linux kernel, the following vulnerability has been resolved: s...

CVE-2026-64002

In the Linux kernel, the following vulnerability has been resolved: i...

BIT-RCLONE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...

SUSE CVE-2026-53369

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-64090

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

CVE-2026-63981

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

CVE-2026-63959

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...