CVE-2026-11809

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

CVE-2026-11809

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

EUVD-2026-55843

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

CVE-2026-11809

CVE-2026-11809 (Zephyr UpdateHub OTA client) : The UpdateHub probe in subsys/mgmt/updatehub/updatehub.c uses a second heap buffer (metadata_copy) via memcpy(metadata_copy, metadata, strlen(metadata)) without zeroing. This omits the terminating NUL, so a subsequent json_obj_parse(metadata_copy, st...

CVE-2026-11809 UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

UBUNTU-CVE-2026-68288

In the Linux kernel, the following vulnerability has been resolved: net: dropmonitor: fix info leak in NETDMATTRPAYLOAD netdmpacketreportfill and netdmhwpacketreportfill open code the NETDMATTRPAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skbcopybits. skbput...

UBUNTU-CVE-2026-68119

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

CVE-2026-68119

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

CVE-2026-68355

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11khalrxmsdulistget When the first entry in msdudetails has a zero buffer address, the code accesses msdudetailsi - 1 with i == 0, causing a buffer underflow. Fix similarly to...

CVE-2026-68089 iio: core: fix uninitialized data in debugfs

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

UBUNTU-CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-71394 Heap Use of Uninitialized Memory in GNU Emacs for Android

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-71394

CVE-2026-71394 affects GNU Emacs for Android. The flaw in sfnt_read_table_directory() (src/sfnt.c) arises from an incorrect read-length check, allowing a crafted font to report more table directory entries than exist and return a structure with uninitialized heap memory in table directory entries...

PT-2026-69949

Name of the Vulnerable Software and Affected Versions UpdateHub OTA client affected versions not specified Description An out-of-bounds and uninitialized-memory read exists in the z impl updatehub probe function within subsys/mgmt/updatehub/updatehub.c. The issue occurs when a probe response from...

CVE-2026-11809: Out-of-bounds Read

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe. The probe response from the UpdateHub server is copied into a heap buffer metadata that is correctly NUL-terminated, but a second buffer metadatacopy is...

PT-2026-69688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the drop monitor component. The functions net dm packet report fill and net dm hw packet report fill manually construct the NET DM ATTR PAYLOAD attribute...

CVE-2026-68119: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

PT-2026-69519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the construction of standalone TCP responses using TCP-AO TCP Authentication Option options. The functions tcp v4 send ack and tcp v6 send response create responses...