CVE-2026-16225

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-45435

A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit h...

CVE-2026-16225 davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write

A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit h...

PT-2026-61401

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read and write issue exists in the adm1266 gpio get multiple function. The function incorrectly uses the PMBus command code ADM1266 PDIO STATUS as an upper bound for...

PT-2026-61264

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp input report hidp input report reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidp recv intr frame pulls the 1-byte...

PT-2026-61233

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom hid set device mode wacom hid set device mode currently assumes that the HID DG INPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify H...

PT-2026-61240

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu mbox handler rep event notify rvu mbox handler rep event notify in drivers/net/ethernet/marvell/ octeontx2/af/rvu rep.c queues a sender-controlled REP EVENT NOTIFY request body verbatim,...

PT-2026-61279

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmode desc per iteration in svdm consume modes svdm consume modes checks pmdata-altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the...

PT-2026-61331

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data len/x len to URB buffer size nexio read data pulls data len and x len from a packed be16 header in the device's interrupt packet and then walks packet-data0..x len and packet-datax len..da...

PT-2026-61326

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write issue exists in the ESP component of the xfrm subsystem. The xfrm state mtu function performs arithmetic in unsigned modulo-2^32 space, subtracting an...

PT-2026-61313

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl len longer than what cmis cdb process reply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be...

PT-2026-61414

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in get gpio i2c info and bios parser get gpio pin info derive an element count from the VBIOS table header.structuresize field,...

PT-2026-61237

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6 datagram recv specific ctl builds IPV6 HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV6 2292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing...

PT-2026-61218

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffer...

PT-2026-61232

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc hci recv from llc and nci hci data received cb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A...

PT-2026-61220

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

PT-2026-61195

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check num entries in GEM OP GET MAPPING INFO kvcallocargs-num entries, sizeofvm entries, GFP KERNEL at amdgpu gem.c:1050 uses the user-supplied num entries directly without any upper bounds check. Since num entries is...

PT-2026-61219

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress m8: validate interrupt packet headers cypress read int callback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

PT-2026-61221

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...

PT-2026-61226

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb check perm dacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smb check perm dacl" introduced a transposed bounds check: if offsetofstruct smb ace, sid + aces size size...