CVE-2026-89266

stb_vorbis (a single-file C library for Vorbis audio decoding) contains a heap buffer overflow in start_decoder() affecting versions through 1.22 . The root cause is a truncation of the codebook multiplicands allocation size from size_t to int, allowing a crafted Ogg Vorbis file with large entrie...

CVE-2026-89471

A flaw was found in the Linux kernel's crosusbpd-charger driver. A malicious or compromised embedded controller EC can report an excessive number of USB Power Delivery PD ports. This causes the driver to write beyond the allocated memory buffer when populating a fixed-size array for port data,...

CVE-2026-89653

A flaw was found in the Linux kernel's Ceph filesystem. This vulnerability occurs when a malicious or malformed MDSMap exporttargets entry, controlled by a monitor, contains a rank value that exceeds the maximum allowed CEPHMAXMDS during the decoding process. This can lead to an out-of-bounds...

CVE-2026-80937

A flaw was found in the Linux kernel's Wi-Fi driver for mt7915 chipsets. This vulnerability allows a malicious or malfunctioning Wi-Fi device to provide an invalid memory address. This can cause the driver to write data beyond its allocated memory, leading to an out-of-bounds write. Such memory...

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-89706

A flaw was found in the Linux kernel's nfsd component. When an asynchronous async copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made durable, resulting in the silent loss of data that was intend...

CVE-2026-89729

A flaw was found in the Linux kernel's Human Interface Device HID sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the sensorhubgetfeature function to write data beyond the intended memory...

CVE-2026-89580

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local attacker could exploit a timing issue in the bpfgetstack function. This occurs when a preemptible BPF program is scheduled out, allowing another task to overwrite a per-CPU buffer. This leads to an out-of-bounds...

CVE-2026-89754

A flaw was found in the Linux kernel's memory management mm/pagewalk component. An issue in the walkpmdrange function, where a stale walk-action state is not properly reset, can lead to duplicate walk callbacks. A local attacker could exploit this to trigger an out-of-bounds write, potentially...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-80986

A flaw was found in the Linux kernel's SMC-Rv2 network component. A remote attacker could exploit this vulnerability by sending a specially crafted message during an SMC-Rv2 link addition. This can lead to a slab-out-of-bounds write, potentially causing a system crash and resulting in a denial of...

CVE-2026-89505

A flaw was found in the Linux kernel's RDMA/uverbs component. Malformed input from a provider in the legacy write path can cause the uverbsgethandlerfn function to dereference an uninitialized pointer. This can lead to a system crash, resulting in a denial of service...

CVE-2026-89761

A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing to specific system files, potentially leading to a denial...

CVE-2026-89633

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

CVE-2026-89617

A flaw was found in the Linux kernel's NTFS3 filesystem driver. An attacker with local access could craft a malicious NTFS log file. During log replay, insufficient validation of the lcnsfollow field in a DIRPAGEENTRY could lead to an out-of-bounds write. This memory corruption could result in a...

CVE-2026-89530

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

CVE-2026-90445 is a path traversal vulnerability in an interface that accepts file uploads from authenticated users . The root cause is that uploaded archives are extracted without validating that file paths remain within the intended destination directory, allowing an attacker to write files to ...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...