UBUNTU-CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

Astra Linux – Vulnerability in edk2

EDK2 contains a vulnerability when the S3 sleep mechanism is activated. In this case, an attacker may cause a Division-by-Zero error due to a UNIT32 overflow through local access. Successful exploitation of this vulnerability could result in a loss of availability...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102700 advisory. libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs...

SUSE CVE-2026-74470

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-74470

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-74470 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

CVE-2026-72175

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: fix makeuffdwphugepte prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up...

PT-2026-72794

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of i flags, and ext4 test inode state applies the corresponding +32 offset. The fast-commit wait and wake paths...

Linux Distros Unpatched Vulnerability : CVE-2026-74470

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds allocle...

CVE-2026-68257 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

PT-2026-69657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the drm/amdkfd component during the calculation of the total cwsr size variable. Because this value is computed using 32-bit integers before being used for...

K000162673: libssh2 vulnerability CVE-2026-58050

Security Advisory Description libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs sizeoflibssh2publickeyattribute without bounds checking, so on 32-bit platforms the multiplication overflows to an...

CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

CVE-2026-64361

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

Linux Distros Unpatched Vulnerability : CVE-2026-64361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When th...

PT-2026-61152

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A divide-by-zero error exists in the batman-adv module within the batadv tp update cwnd function. The issue occurs during the calculation of dec cwnd when the cwnd variable reaches the...

SUSE SLES16 Security Update : jq (SUSE-SU-2026:22637-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22637-1 advisory. This update for jq fixes the following issues - CVE-2026-43896: unbounded recursion in jvobjectmergerecursive can lead to C stack...

CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk. When such branches are combined into a trie, the...

PYSEC-2026-1001 `CHECK` fail in `BCast` overflow

Impact If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. python import tensorflow as tf value = tf.constantshape=2, 1024, 1024, 1024...