53828 matches found
kernel: ice: fix double-free of tx_buf skb
A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...
CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
CVE-2026-19566 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
CVE-2026-19566 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
CVE-2026-19566 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
Security Bulletin:Vulnerability in httpcore affects IBM Netezza Appliance
Summary The httpcore package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-54399 Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core...
EUVD-2025-210706
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted...
JLSEC-2026-1257 Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function...
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mgtlsserverrecvhello, which uses an attacker-controlled sessionidlen byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated...
CVE-2026-12234
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12233
The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...
CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write
The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...
CVE-2026-12233
CVE-2026-12233 affects the PSA Protected Storage TLS credential backend. The credential_store mutex was declared as a zero-initialized static k_mutex and never initialized, leaving its wait queue NULL. Under contention, z_pend_curr() appends to this uninitialized wait queue and dereferences a NUL...
CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...
CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...
CVE-2026-12232 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...
CVE-2026-12232 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...
CVE-2026-19587
Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation...
libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation
A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution...