PT-2026-65437

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being...

CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

UBUNTU-CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

SUSE CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

UBUNTU-CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380

The CVE-2026-64380 issue affects the Linux kernel SMB client path handling of POSIX SIDs. The root cause is in posix_info_sid_size(), which reads sid[1] to obtain the subauthority count but previously allowed buffers with only one remaining byte, potentially enabling unsafe rejection of truncated...

EUVD-2026-48924

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64339

CVE-2026-64339 affects the Linux kernel USB IO stack (usbio_bulk_msg). A malicious device that advertises a large bulk OUT and small bulk IN endpoint can set bpkt_len (from bpkt->len) to exceed rxbuf_len, causing memcpy to read past rxbuf and leak adjacent slab memory via i2c-dev. The code alr...

PT-2026-64601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client regarding the parsing of POSIX SID lengths. The function posix info sid size reads sid1 to determine the subauthority count, but the boundary check...

DEBIAN-CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

EUVD-2026-48617

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

CVE-2026-64209

In the Linux kernel, the issue resides in phy: qcom: qmp-usbc, where swing_tbl and pre_emphasis_tbl (both 4x4, valid indices 0–3) may be accessed out of bounds due to a boundary check using > 4 instead of >= 4. This permits index 4 to slip through, causing an out-of-bounds read/write as des...

SUSE CVE-2026-63838

In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of componentdais componentdaisRSNDMAXCOMPONENT is initially zero-initialized and later populated in rsnddaiofnode. However, the existing boundary check: if i = RSNDMAXCOMPONENT does...

PT-2026-64324

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access exists in the qmp-usbc component of the qcom phy. The swing tbl and pre emphasis tbl are defined as 4x4 arrays with valid indices from 0 to 3. However, the...

SUSE CVE-2026-63908

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63838

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Renesas Sound rsnd component. An incorrect boundary check during the population of the componentdais array can lead to an out-of-bounds memory access. This vulnerability occurs because a loop relies ...

Linux Distros Unpatched Vulnerability : CVE-2026-63908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known...

CVE-2026-63908

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-63838

In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of componentdais componentdaisRSNDMAXCOMPONENT is initially zero-initialized and later populated in rsnddaiofnode. However, the existing boundary check: if i = RSNDMAXCOMPONENT does...