CVE-2026-63796

A flaw was found in the Linux kernel's Oracle Cluster File System 2 ocfs2. A local attacker could craft a malicious group bitmap descriptor that claims a size exceeding the physically allocated bitmap bytes. This improper input validation allows subsequent operations to read or write beyond the...

CVE-2026-64151

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit page table driver. This vulnerability involves a missing check for the system's fundamental memory page size PAGESIZE within the pgsizebitmap data structure. While an IOMMU configuration with this missing check would...

PT-2026-62064

Name of the Vulnerable Software and Affected Versions Data::RoaringBitmap::Shared versions prior to 0.02 Description This issue occurs when creating a world-readable mmap backing file and opening it without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode...

PT-2026-62050

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb contains locked. The attach-time validator rb validate header checks the header scalars and region layout against the file size, but does not validate th...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3815 (ALAS-2026-3815)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3815 advisory. BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow...

GHSA-45HQ-CXWH-F6VC Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

GHSA-5X94-69RX-G8H2 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

GHSA-8V84-F9PQ-WR9X Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

CVE-2026-63830

A flaw was found in the Linux kernel's skmsg networking component. This vulnerability arises when the sg.copy bitmap, which controls memory access permissions, is not properly maintained during data transformations. This can allow a local attacker to bypass memory protection mechanisms, enabling...

CVE-2026-64118

A flaw was found in the Linux kernel's qed driver. This vulnerability involves a double free error in the qedcxttablesalloc function, where memory is deallocated twice if a Connection ID CID bitmap allocation fails. This can lead to memory corruption, potentially allowing a local attacker to caus...

USN-8560-1: libXfont vulnerabilities

It was discovered that libXfont incorrectly handled scaling bitmap fonts, leading to a heap buffer overflow. An attacker able to access the X server could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-56001 It was...

ocfs2: reject oversized group bitmap descriptors

...

Linux Distros Unpatched Vulnerability : CVE-2026-64118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously...

Oracle Linux 10 : kernel (ELSA-2026-25191)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25191 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Important: libXfont2

Issue Overview: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow CVE-2026-56002 computeProps Property Buffer Heap Buffer Overflow CVE-2026-56003 Affected Packages: libXfont2 Issue Correction: Run dnf update libXfont2 --releasever...

Linux Distros Unpatched Vulnerability : CVE-2026-64151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGESIZE in the pgsizebitmap Sashiko pointed out that the driver...

SUSE CVE-2026-63796

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2validategdparent only bounds bgbits against the parent allocator's chain geometry. A malicious descriptor can still claim a bgsize/bgbits pair that exceeds the bitmap bytes th...