7511 matches found
Infinite loop
Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Infinite loop via parseNestedParens in twisted/mail/imap4.py when processing an IMAP SEARCH command containing a literal with a negative octet count...
DEBIAN-CVE-2026-98958
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-98958
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
UBUNTU-CVE-2026-98958
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-98958
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-99003
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...
EUVD-2026-108932
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-98958 wifi: mt76: account non-AQL frames per peer rather than per link
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-98958 wifi: mt76: account non-AQL frames per peer rather than per link
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
CVE-2026-98958
The Linux kernel contains a vulnerability in the wifi: mt76 driver. The driver incorrectly accounts for non-AQL frames by incrementing a counter when a frame enters the hardware queue and decrementing it upon completion. For MLO peers , the hardware may report completion on a different link than ...
CVE-2026-98900
In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...
PT-2026-121930
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-non aql packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...
PT-2026-121956
In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...
PT-2026-122155
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The ra...
CVE-2026-103634
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. countminsketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
CVE-2026-103634 Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. countminsketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
EUVD-2026-108025
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. countminsketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
CVE-2026-103634 Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. countminsketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
PT-2026-121278
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. count min sketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
Apache DataSketches numerical error vulnerability
A security vulnerability exists in Apache DataSketches C++ versions from 4.1.0 up to and including 5.3.0. This vulnerability arises because the Count-Min sketch fails to include the leading part of the input size during deserialization; additionally, there is a 32-bit integer wrap-around in table...