CVE-2026-90034 usb: image: mdc800: change kmalloc() to kzalloc()

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential stack leaks if a shorter message is received in mdc800usbirq and...

CVE-2026-90034

CVE-2026-90034 affects the Linux kernel's usb_mdc800 driver (USB Image MDC800). The root cause is the use of kmalloc() instead of kzalloc() for the irq_urb_buffer and download_urb_buffer allocations in usb_mdc800_init(). Because the memory is not zero-initialized, a shorter-than-expected message ...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

EUVD-2026-80458

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

EUVD-2026-80452

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

Linux Distros Unpatched Vulnerability : CVE-2026-90034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential...

CVE-2026-90034: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential stack leaks if a shorter message is received in mdc800usbirq and...

Astra Linux – Vulnerability in busybox

A issue was discovered in BusyBox before version 1.30.0. A out-of-bounds read in udhcp components used by the DHCP server, client, and relay allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This issue is related to the verification in...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel’s implementation of RDMA over InfiniBand. An attacker with a privileged local account can leak kernel stack information by issuing commands to the /dev/infiniband/rdmacm device node. Although this access is unlikely to reveal sensitive user information, i...

CVE-2026-89698

A flaw was found in the Linux kernel's nfsd component. When an IPv6 NFS client is connected, the nfsdgenlrpcstatuscomposemsg function incorrectly handles address fields, leading to an out-of-bounds read. A local unprivileged attacker can exploit this vulnerability to disclose sensitive kernel...

CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

DEBIAN-CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

UBUNTU-CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

CVE-2026-80952 i3c: master: Fix info leak and UAF in device unregister path

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

PT-2026-90057

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the timekeeping component where the return value of the tk get aux ts64 function is not properly checked within do adjtimex. If the auxiliary clock is disabled...

PT-2026-90082

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak and use-after-free UAF issue exists in the i3c master device unregister path. The function i3c master unregister i3c devs clears the i3cdev-dev-desc before calling...

AZL-99594 CVE-2026-80761 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

CVE-2026-80761

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

EUVD-2026-71437

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...