CLSA-2025-1757961864 kernel: Fix of 34 CVEs

inet: fully convert sk-skrxdst to RCU rules CVE-2021-47103 - ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - can: peakusb: fix use after free bugs CVE-2021-47670 -...

CLSA-2024-1725876080 kernel: Fix of 45 CVEs

dmaengine: idxd: Fix possible Use-After-Free in irqprocessworklist CVE-2024-40956 - userfaultfd: fix a race between writeprotect and exitmmap CVE-2021-47461 - netfilter: nftables: use timestamp to check for set element timeout CVE-2024-27397 - x86/sev: Harden VC instruction emulation somewhat...

CLSA-2026-1771077729 kernel: Fix of 108 CVEs

net/ieee802154: don't warn zero-sized rawsendmsg CVE-2022-50706 - bpf: Don't redirect packets with invalid pktlen CVE-2022-49975 - media: uvcvideo: Fix 1-byte out-of-bounds read in uvcparseformat CVE-2025-38680 - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network...

CVE-2026-111997

A flaw was found in ip-address. A remote attacker can cause a Denial of Service DoS by providing specially crafted input containing excessive percent characters to an application parsing IPv6 addresses. When processed by the Address6 constructor, inefficient parsing logic leads to high CPU...

PT-2026-116761

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR NOCPUS in remote partition enable on subpartitions cpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRS MEMBER intermediate cgroup, update...

PT-2026-116777

In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...

CVE-2026-111997: Inefficient Regular Expression Complexity

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2023:1701962635)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2023:1701962635 advisory. - An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.6 contains security vulnerabilities. These vulnerabilities stem from the htabmaplookupanddeletebatch function not having a re-scheduling point, which may lead to a CPU soft lock...

Beau Gunderson ip-address resource management error vulnerability

Beau Gunderson’s IP-address version prior to 10.7.4 contains a resource management error vulnerability. This vulnerability arises from functions that accept inputs containing a large number of '%' characters and invoke the Address6 constructor function. This leads to a quadratic complexity, causi...

Exploit for CVE-2026-64560

CVE-2026-64560 — realme RMX6699 Android 17 / COOS17 !andr...

Exploit for CVE-2026-64560

OPPO Find X10 Pro Max PMX110 / OP659FL1 · CVE-2026-64560 Res...

CLEANSTART-2026-XJ89582 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-YF57213 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

EUVD-2026-103195

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

Linux Distros Unpatched Vulnerability : CVE-2026-110755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the...

DEBIAN-CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755

A flaw was found in Text::CSVXS. This vulnerability allows an attacker to cause a Denial of Service DoS by providing specially crafted comma-separated value CSV input using carriage return CR-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data acros...

CVE-2026-110755

The Text::CSV_XS Perl module (versions before 1.65 ) is vulnerable to quadratic CPU use (CWE-407) due to an inefficient algorithmic complexity in the getline function. When the eol option is unset, input featuring carriage return (CR )-only line endings is treated as a single chunk. The parser re...