UBUNTU-CVE-2026-58187

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.1...

CVE-2026-58187 Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.1...

The vulnerability of the ipv4 component in the Linux operating system’s kernel allows attackers to increase their privileges and cause service interruptions.

The vulnerability of the ipv4 component in the Linux operating system’s kernel is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges and cause service interruptions...

buffer overruns in libfsimage iso9660 handling

ISSUE DESCRIPTION The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: The directory loop itself assumes a good record length. This is CVE-2026-42494. The calculation of the System...

The vulnerability of the __aq_ring_rx_clean() function in the drivers/net/ethernet/aquantia/atlantic/aq_ring.c module of the Ethernet network adapter driver for the AQuantia Atlantic chipset in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the aqringrxclean function in the drivers/net/ethernet/aquantia/atlantic/aqring.c module of the Ethernet network adapter driver for the AQuantia Atlantic chipset in the Linux operating system is related to buffer out-of-buffer writing. Exploiting this vulnerability could allo...

UBUNTU-CVE-2026-58264

heap-based buffer overrun in command handler...

SUSE CVE-2026-64268

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

CVE-2026-64268

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

UBUNTU-CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

CVE-2026-64520 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

EUVD-2026-48864

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64520 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64354 bpf: Validate BTF repeated field counts before expansion

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btfparsestructmetas walks user-supplied BTF during BPFBTFLOAD, and btfrepeatfields expands repeatable fields from array elements into the fixed BTFFIELDSMAX scratch array...

EUVD-2026-48982

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114interrupt reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114touch touchMMS114MAXTOUCH; which holds MMS114MAXTOUCH 10 events of...

CVE-2026-64268 RDMA/siw: bound Read Response placement to the RREAD length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then accumulates wqe-processed, but i...

CVE-2026-64268

CVE-2026-64268 concerns a Linux kernel vulnerability in the SIW (RDMA) path where Read Response segments could overrun the sink buffer. The issue resides in siw_qp_rx.c (siw_proc_rresp) which places inbound Read Response DDP segments at sge->laddr + wqe->processed and accumulates processed ...

PT-2026-64489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA siw driver where the siw proc rresp function fails to check the running total of inbound Read Response DDP segments against the sink buffer length on...

PT-2026-64704

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight packet takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32 to cpupayload-sample count...

ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel...

EUVD-2026-46447

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...