Linux Distros Unpatched Vulnerability : CVE-2026-90435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift...

AZL-102194 CVE-2026-90435 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90435

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-91962

A flaw was found in FreeRDP. An integer overflow in the audin Apple backends, specifically when processing FramesPerPacket values from MSGSNDINOPEN messages, allows a malicious RDP Remote Desktop Protocol server to supply crafted values. This can cause the AudioQueueAllocateBuffer size computatio...

Linux Distros Unpatched Vulnerability : CVE-2026-89724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose...

CVE-2026-89724 media: vicodec: fix out-of-bounds write in FWHT encoder

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

EUVD-2026-76636

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

PT-2026-90440

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc s fmt vid out sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt fwht, whose sizeimage mult is 3: coded w coded h 3 + sizeofstruct fwht cframe hdr...

MGASA-2026-0348 Updated clamav packages fix security vulnerabilities

An indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. CVE-2026-20345 An integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. CVE-2026-20339 An integ...

CVE-2026-80710

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

EUVD-2026-67445

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80710

CVE-2026-80710 affects the s390/dasd subsystem of the Linux kernel. In dasd_eckd_check_device_format(), the variable fmt_buffer_size is declared as a 32-bit int, but the expression trkcount * rpt_max * sizeof(struct eckd_count) is evaluated at 64-bit width. When the track range (controlled by cal...

CVE-2026-80710

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-74657

A flaw was found in the Linux kernel. The fibnlmsgsize function, which estimates the size for network message buffers, incorrectly calculates the required space for nexthops when IPv4 routes contain an IPv6 gateway. This error can lead to the allocation of an undersized buffer for route...

EUVD-2026-64594

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fibnlmsgsize for RTAVIA nexthops fibnlmsgsize still estimates nexthop space as if every gateway is encoded as an IPv4 RTAGATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fibnexthopinfo dumps as RTAVI...

Linux Distros Unpatched Vulnerability : CVE-2026-70652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output...

ANT-2026-ZGY30A9P · c-blosc2 · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZGY30A9P: Heap buffer overflow in compressio...

CVE-2026-47714

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in libheif/region.cc contains an integer overflow. Both width and height are unsigned int 32-bit values parsed from the HEIF file. Their product can exceed UINT32MAX, wrapping to...

CVE-2026-47714

The issue is a concrete, exploitable flaw in libheif up to version 1.21.2 (patched in 1.22.0) where inline mask size calculation in libheif/region.cc can overflow while parsing width and height as 32-bit unsigned ints. Their product can exceed UINT32_MAX, causing an undersized allocation and out-...