UBUNTU-CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450

CVE-2026-89450 affects the Linux kernel's iommu/tegra241-cmdqv module. The function tegra241_vintf_init_vsid() programs a guest-provided virtual Stream ID (vSID) into the SID_MATCH register, whose VIRT_SID field spans only 20 bits (bits [20:1]). The existing bound check rejects only virt_sid >...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

EUVD-2026-76356

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

PT-2026-90166

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra241 vintf init vsid function where a guest-provided virtual Stream ID vSID is programmed into the SID MATCH register. The hardware only supports a 20-bit Stre...

GHSA-RF44-J88R-HH8C Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) is vulnerable to identity spoofing via dot-form header aliasing in versions v1.x, v2.x–v2.11.55, and v3.0.0–v3.7.11. Because Go canonicalizes header names on dashes only, a client can send a dot-form alias (e.g., X.Authenticated.User) alongside the c...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

The vulnerability of the sprd_spi_probe() function in the drivers/spi/spi-sprd.c module of the Linux operating system’s SPI device driver allows a hacker to cause a service failure.

The vulnerability of the sprdspiprobe function in the drivers/spi/spi-sprd.c file of the Linux kernel’s SPI device driver relates to pointer aliasing. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

CVE-2026-81638

ash_double_entry (Elixir library by ash-project) contains an Improper Handling of Alternate Encoding vulnerability in its ULID type. Although a 128-bit ULID is rendered as 26 Crockford base-32 characters, the first character encodes only 3 bits (canonical values 0–7). The decode/1 function masks ...

The vulnerability of the alloc_branch() function in the fs/sysv/itree.c file of the Linux kernel file system allows a attacker to cause a service failure.

The vulnerability of the allocbranch function in the fs/sysv/itree.c file of the Linux kernel operating system is related to pointer aliasing. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the iSCSI Target Service for Windows operating systems allows a hacker to trigger a service failure.

The vulnerability of the iSCSI Target Service for Windows operating systems is related to pointer aliasing. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...