kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

CVE-2026-80741 drm/log: Fix out-of-bounds read on empty message length

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

EUVD-2026-70345

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

CVE-2026-80634

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid numencaps underflow on bridge VLAN untag The DEVPATHBRVLANUNTAG case post-decrements info-numencaps inside WARNONONCE. numencaps is u8, so if it's already 0 the decrement still happens and wraps it to...

CVE-2026-80584 s390/qeth: validate user buffer length in SNMP and ARP query ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...

AZL-97203 CVE-2026-74671 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-74671

CVE-2026-74671 is an out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem, specifically in the xattr_verify() function. The root cause is a type mismatch between int and size_t in the digest-length check: sizeof() promotes the entire left-hand expression to ...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100588)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100588 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject ssysblocksize smaller than OMFSDIRSTART omfsfillsuper rejects oversized...

UBUNTU-CVE-2026-72367

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow

In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a...

CVE-2026-73433 Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-68145

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

CVE-2026-59090

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

CVE-2026-59090 Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

CVE-2026-59090

CVE-2026-59090 is a critical vulnerability in GIMP's PSD file format plugin , caused by an unsigned integer underflow in the block_rem variable. When a user opens a specially crafted .psd file , the underflow causes parser confusion that allows an attacker to inject arbitrary data as layer resour...

EUVD-2026-55616

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...