CLSA-2026-1792795786 Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

SECURITY UPDATE: out-of-bounds repeat stack access in Onigmo - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat or null-check count overflows the internal ID type in include/ruby/onigmo.h, regcomp.c, regerror.c. - CVE-2026-110264 SECURITY UPDATE: wrapped jump offsets in...

CLSA-2026-1792795609 Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

SECURITY UPDATE: out-of-bounds repeat stack access in regexps - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat or null-check count overflows the ID type in regcomp.c - CVE-2026-110264 SECURITY UPDATE: wrapped jump offsets in compiled regexps -...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792751700)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792751700 advisory. - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len =...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF: Protection against integer overflows for stack access sizes This patch reintroduces protection against access to stack memory having a negative value. The access size can appear negative due to overflow in its signed integer...

CVE-2026-82343

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...

SUSE CVE-2026-62433

Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...

CVE-2026-62433

Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...

EUVD-2026-39887

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Push kjump return address even for non-kjump kexec The version of purgatory code shipped by kexec-tools attempts to look above the top of its stack to find a return address for a kjump, even in a non-kjump kexec. After...

PT-2026-3853

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be...

Siemens SIMATIC Devices Improper Validation of Array Index (CVE-2024-35905)

In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int...

EUVD-2024-37397

Malicious code in bioql PyPI...

EUVD-2024-52025

Malicious code in bioql PyPI...

objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()

...

bpf: support non-r10 register spill/fill to/from stack in precision tracking

...

PT-2025-29042

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.0+ 11 Description: A stack-out-of-bounds read issue was identified in the regs get kernel stack nth function within the Linux kernel. The issue was reported by KASAN Kernel Address Sanitizer and is related t...

CVE-2024-38533

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access the stack not properly being converted to cells. This issue has been patched in version 1.5.0...

CVE-2025-40014

In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amdsetspifreq If speedhz AMDSPIMINHZ, amdsetspifreq iterates over the entire amdspifreq array without breaking out early, causing 'i' to go beyond the array bounds. Fix that by...

UBUNTU-CVE-2025-39778

In the Linux kernel, the following vulnerability has been resolved: objtool, nvmet: Fix out-of-bounds stack access in nvmetctrlstateshow The cstsstatenames array only has six sparse entries, but the iteration code in nvmetctrlstateshow iterates seven, resulting in a potential out-of-bounds stack...

CVE-2025-40014: Improper Validation of Array Index

In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amdsetspifreq If speedhz AMDSPIMINHZ, amdsetspifreq iterates over the entire amdspifreq array without breaking out early, causing 'i' to go beyond the array bounds. Fix that by...

PT-2025-17284

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.1 Description The issue is related to an out-of-bounds stack access in the amd set spi freq function. When speed hz is less than AMD SPI MIN HZ, the function iterates over the entire amd spi freq array witho...