PT-2026-79603

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6 route rcv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of...

PT-2026-79717

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create direct keys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd exec+0x550/0xca0 mlx5 core Read of size 272 at addr 0000000176795020 by task...

PT-2026-79715

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

PT-2026-79729

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip vs nat icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One...

Linux Distros Unpatched Vulnerability : CVE-2026-74640

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 25...

Linux Distros Unpatched Vulnerability : CVE-2026-74693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject...

Linux Distros Unpatched Vulnerability : CVE-2026-74612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area,...

PT-2026-79688

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev get mask cnt and client evmasks arra...

Linux Distros Unpatched Vulnerability : CVE-2026-74580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok...

PT-2026-79653

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw cfg80211 monitor if xmit entry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data...

Linux Distros Unpatched Vulnerability : CVE-2026-74665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the...

PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

Linux Distros Unpatched Vulnerability : CVE-2026-74641

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset =...

PT-2026-79655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the WMM param handler function within the rtl8723bs staging driver. The function copies a fixed-size WMM parameter element from a received information...

PT-2026-79674

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip vs in icmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp send. However, IPCBskb-opt still describes the outer IPv4...

PT-2026-79694

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc setsockopt vcc setsockopt contained an ineffective optlen check: if SO LEVEL MATCHoptname, level && optlen != SO SIZEoptname return -EINVAL; If SO LEVEL MATCHoptname, level evaluated to...

PT-2026-79602

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: clear skb2-cb in ip6ip6 err ip6ip6 err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6 send. The clone still carries the outer packet's inet6 skb parm...

Linux Distros Unpatched Vulnerability : CVE-2026-74598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both chec...

PT-2026-79608

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink info version fixed put treats it as a C string and may read beyond th...

PT-2026-79568

hashcat contains a heap-based buffer overflow out-of-bounds write in the outfile write function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZ LARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating tha...