EUVD-2026-76340

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

CVE-2026-81017 platform/chrome: sensorhub: Bound the EC-reported sensor number

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

CVE-2026-80943

CVE-2026-80943 is an out-of-bounds array access in the Linux kernel's rtlwifi driver (rtl8192du). The function rtl92du_tx_fill_desc() uses a QoS TID value (range 0–15) as an index into sta_entry->tids[], which only allocates 9 entries (MAX_TID_COUNT). A TID greater than 8 therefore reads past ...

EUVD-2026-76266

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107299 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow WHY & HOW Make sure vmid0p72idx,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107265)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107265 advisory. In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in mdcheckrecovery Usually if the array is not read-write,...

PT-2026-96481

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array block check can only compare the header against itself, so a block with value size 4 and max entries 1018 is internally consistent and passes. dm-cache...

PT-2026-90289

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array where the array block check function only compares a header against itself, allowing internally consistent blocks with mismatched value sizes to pass. In...

PT-2026-90290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array component where array block headers are not properly validated during read operations. The array block check function only validates the block number and...

PT-2026-90308

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description The rocket job push function contains a NULL pointer dereference and an integer overflow. The function allocates a temporary array to store input and output GEM object pointers. A failure in...

CVE-2026-80943: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92dutxfilldesc uses ieee80211gettid to read the QoS TID from the 802.11 header and then uses it as an index into staentry-tids. ieee80211gettid returns the low 4-bit...

PT-2026-96352

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array block check validates blocknr and csum and nothing else, while node check, next to it, has bounded the structural fields since both were written. dm array cursor next takes its...

CVE-2026-89574: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

PT-2026-90479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the trusted key subsystem where the trusted tpm exit function releases the TPM chip reference and frees the digest array before unregistering the trusted key type. Thi...

The vulnerability of the decoder handlers in the BGP OPEN messages parser of the GoBGP edge gateway module pkg/packet/bbg protocol allows a attacker to cause a service failure.

The vulnerability of the decoder handlers for BGP OPEN messages in the GoBGP border gateway module’s pkg/packet/bbg protocol relates to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-90331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs3 file system where a crafted log record can cause an overflow of the page lcns array. This occurs because the copy lcns loop and the redo shorten loop index...