77011 matches found
PT-2026-90470
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walk pmd range If -pmd entry sets walk-action = ACTION AGAIN, the pmd none check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-install pte is...
PT-2026-90144
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...
PT-2026-90338
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp i2c smbus read stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. On...
PT-2026-90221
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method elm The legacy write path dispatches through a uverbs api write method, but the uverbs attr bundle passed to provider code does not have an ioctl method element. If malformed...
PT-2026-90413
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh want write for early-verified SETATTR in nfsd proc setattr The BOTH TIME SET branch calls fh verify early so setattr prepare can inspect the dentry. This causes nfsd setattr to skip fh want write, so notify change ru...
PT-2026-90369
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export targets ranks = CEPH MAX MDS in mdsmap decode MDSMap export targets entries are monitor controlled. check new map uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespa...
PT-2026-90513
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...
PT-2026-89804
Patch CVE-2026-16338 immediately. Learn how this 9.9 CVSS flaw allows arbitrary file write attacks in IBM DataStage and how to secure your data today. CVE202616338 IBMDataStage CyberSecurity InfoSec ArbitraryFileWrite CloudSecurity Vulnerability https://t.co/k9OgrO33Vv https://t.co/lVFSA4z6H7...
PT-2026-90147
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensor num. cros ec sensorhub ring handler validates the FIFO event count, the per-read count and the ring bound...
CVE-2026-90445: Improper Limitation of a Pathname to a Restricted Directory
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...
CVE-2026-89653: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...
CVE-2026-89656: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...
CVE-2026-89674: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...
CVE-2026-89559: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89495: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...
CVE-2026-89505: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...
CVE-2026-81017: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...
RockyLinux 8 : vim (RLSA-2026:66348)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66348 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service vi...
PT-2026-90368
In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...
PT-2026-90477
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa vec unique null terminates at vecn - dups when VEC FLAG TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...