golang: cmd/compile: possible memory corruption after bound check elimination

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially...

golang: cmd/compile: possible memory corruption after bound check elimination

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially...

CVE-2026-10682 Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

The userspace verifier zvrfylogfilterset for the logfilterset syscall in subsys/logging/logmgmt.c performed a signed comparison against the int16t srcid parameter: srcid int16tlogsrccntgetdomainid. Any negative value for srcid e.g. -1 trivially satisfied this check and was forwarded into...

CVE-2026-64293

A flaw was found in the Linux kernel's iommufd component. This vulnerability arises from an incorrect size calculation during a bound-check in the iommufdveventqfopsread function. On 32-bit systems, this error can lead to an out-of-bounds write, allowing data to be copied past the intended...

EUVD-2026-49110

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

SUSE CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64304

In the Linux kernel, CVE-2026-64304 affects the crypto qat driver: the RSA CRT component handling in qat_rsa_setkey_crt() can write out of bounds when a CRT component exceeds the allocated half-key buffer, causing memory corruption. The root cause is that the generic RSA key parser bounds compone...

CVE-2026-64296

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64293

CVE-2026-64293 affects the Linux kernel iommufd component. A 32-bit bound-check in iommufd_veventq_fops_read() uses sizeof(hdr) (size of the pointer) instead of sizeof(*hdr), causing under-count of the vEVENT header and potentially writing past the user buffer during header+data payload copy. Mul...

CVE-2026-64268 RDMA/siw: bound Read Response placement to the RREAD length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

PT-2026-64514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd veventq fops read function where a bound-check for the normal vEVENT path incorrectly uses sizeofhdr instead of sizeofhdr. Because hdr is a pointer,...

SUSE CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

SUSE CVE-2026-63878

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

SUSE CVE-2026-63962

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmodedesc per iteration in svdmconsumemodes svdmconsumemodes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. I...

CVE-2026-63962 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmodedesc per iteration in svdmconsumemodes svdmconsumemodes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. I...

CVE-2026-63962 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmodedesc per iteration in svdmconsumemodes svdmconsumemodes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. I...

CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...