kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

CVE-2026-80847: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAXADVMSS is one way to get...

PT-2026-85635

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers nci rf discover ntf packet and nci rf intf activated ntf packet each parse a notification into an on-stack struct nci rf discover ntf / nci rf intf activated nt...

PT-2026-85725

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A divide-by-zero issue exists in the TCP implementation. The tcp select initial window function assumes that the Maximum Segment Size MSS passed to it is never smaller than 1. However,...

Linux Distros Unpatched Vulnerability : CVE-2026-80847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate...

Linux Distros Unpatched Vulnerability : CVE-2026-80742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afpacket: Don't send zero-byte data in tpacketsnd. syzbot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at...

PT-2026-91345

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP MIN MSS tcp select initial window assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAX ADVMSS is one way to g...

PT-2026-85730

In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds write in tls append frag Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls device.c is otherwise only reachable on a machine with a NIC that...

Linux Distros Unpatched Vulnerability : CVE-2026-80731

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for...

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

UBUNTU-CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

EUVD-2026-70735

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458

CVE-2026-85458 is a divide-by-zero vulnerability in Xpdf 4.06 (and earlier) triggered when a Type 3 font contains a glyph with a zero height . The bug causes a low-availability impact, rated CVSS 4.0 base score 2.1 (LOW) with a local attack vector and high complexity. No exploitation or in-the-wi...

CVE-2026-85458 Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458 Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

SUSE CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

SUSE CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...