UBUNTU-CVE-2026-46198

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buffpos Fixing an integer overflow present in batadvivogmsendtoif. The size check is done using the int type in batadvivogmaggrpacket whereas the buffpos variable uses the s16 type. This could...

CVE-2026-46198

The CVE-2026-46198 issue affects the Linux kernel’s batman-adv component. A mismatch between integer types caused an integer overflow in batadv_iv_ogm_send_to_if, where buff_pos is s16 while the size check uses an int in batadv_iv_ogm_aggr_packet, potentially enabling an out-of-bounds read. The v...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from integer overflow in the buffpos field within batman-adv. Due to size checks using the int type an...

PT-2026-44321

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff pos Fixing an integer overflow present in batadv iv ogm send to if. The size check is done using the int type in batadv iv ogm aggr packet whereas the buff pos variable uses the s16 type...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. The vulnerability exists due to a mishandled buffer position...

oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.

...

DEBIAN-CVE-2020-14415

osswrite in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position...

CVE-2020-14415

osswrite in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position...

UBUNTU-CVE-2020-14415

osswrite in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position...

Qemu: audio: intel-hda: infinite loop in processing dma buffer stream

The intelhdaxfer function in hw/audio/intel-hda.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via an entry with the same value for buffer length and pointer position...