124 matches found
CVE-2026-94368: Improper Verification of Cryptographic Signature
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...
CVE-2026-24074
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...
CVE-2026-24074
CVE-2026-24074 is an out-of-bounds write in a Video component on Qualcomm platforms. The root cause is memory corruption that occurs when data with large offset and length values exceeds buffer limits during data copy operations. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low co...
EUVD-2026-81321
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...
CVE-2026-24074 Out-of-bounds Write in Video
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...
CVE-2026-24074 Out-of-bounds Write in Video
Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...
CVE-2026-64395
Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...
CVE-2026-64395 ksmbd: require source read access for duplicate extents
In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...
CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...
PT-2026-64616
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the FSCTL DUPLICATE EXTENTS TO FILE control code passes the source file to vfs clone file range or vfs copy file range without verifying the SMB access mask of the...
SUSE CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...
CVE-2026-63831 mac802154: llsec: add skb_cow_data() before in-place crypto
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform in-place cryptographic transformations on skb data. They build a scatterli...
PT-2026-61147
Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description In the Linux kernel, the mac802154 module performs in-place cryptographic transformations on socket buffer skb data using the functions llsec do encrypt unauth, llsec do encrypt auth,...
PT-2026-61277
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wcove read rx buffer function where the PD RX FIFO is copied into the struct pd message. This process is susceptible to a buffer overflow due to two factors. First...
Linux Distros Unpatched Vulnerability : CVE-2026-53186
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/srp: bound SRPRSP sense copy by the received length srpprocessrsp copies sense data from rsp-data + respdatalen, where respdatalen is the full 32-bit value...
CVE-2026-53076
A flaw was found in the Linux kernel. This vulnerability, located in the BPF Berkeley Packet Filter subsystem, involves an out-of-bounds read when data is copied between specific types of BPF maps. The system incorrectly handles data sizes that are not aligned to a specific memory boundary, causi...
UBUNTU-CVE-2026-53148
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...
CVE-2026-53148
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...
CVE-2026-53148 thunderbolt: Clamp XDomain response data copy to allocation size
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...