CVE-2026-108573

A flaw was found in assimp. A remote attacker could exploit this vulnerability by providing a specially crafted Polygon File Format PLY file, triggering an out-of-bounds read in the buffer parsing mechanism. This issue can cause an application crash, resulting in a Denial of Service DoS, or...

CVE-2026-90137

A flaw was found in the Linux kernel's hp-bioscfg component. The password encoding parser, specifically the PSWDENCODINGS parser, does not adequately validate the number of entries when processing an ACPI Advanced Configuration and Power Interface package. A malformed ACPI package can cause the...

CVE-2026-90122

A flaw was found in the Linux kernel's Visconti clock driver. The clkinitdata structure, which manages clock parent data, may not be fully initialized. This uninitialized data can lead to a system crash when the visconticlkregistergate function is called under specific kernel configurations. This...

CVE-2026-90123

A flaw was found in the Linux kernel's irqchip/ast2700-intc component. An invalid memory allocation attempt occurs within the irqdomainactivate callback while interrupts are disabled and a spinlock is held. This condition, triggered by the fwnodedeviceiscompatible function, can lead to system...

CVE-2026-90117

A flaw was found in the Linux kernel's NTFS filesystem driver. When reusing a free Master File Table MFT record, the driver fails to properly validate an offset value from the on-disk record. A local attacker could exploit this by creating a specially crafted file, leading to a use-after-free err...

CVE-2026-90114

A flaw was found in the Linux kernel's networking bridge component. When processing specially crafted VLAN Virtual Local Area Network tunnel ranges, a logic error can occur where descending VLAN and tunnel IDs are incorrectly handled. This can lead to an unpredictable return value, potentially...

CVE-2026-90101

A flaw was found in the Linux kernel's Broadcom NetXtreme-C/E bnxten network adapter driver. The driver incorrectly calls the hardware monitoring event handler function hwmonnotifyevent with an incorrect parameter. This improper function call can lead to undefined behavior and may result in a...

CVE-2026-90100

A flaw was found in the Linux kernel's Precision Time Protocol PTP netc driver. An issue with period calculation can lead to a value being truncated to zero. This truncated value can then cause a divide-by-zero error in the netctimersetperoutalarm function, resulting in a system crash and a Denia...

CVE-2026-90098

A flaw was found in the Linux kernel's net: sparx5 driver. The sparx5setrxmode function attempts to acquire a mutex and poll a register while operating in an atomic context, which is not allowed. This improper operation can lead to a "sleep in atomic context" bug, causing system instability or a...

CVE-2026-90074

A flaw was found in the Linux kernel's fqpie network scheduler. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit this by configuring a network device with a specially crafted large Maximum Transmission Unit MTU value. This can lead to a signed integer overflow,...

CVE-2026-90073

A flaw was found in the Linux kernel. An integer overflow vulnerability exists in the Hierarchical Heavy-Hitter Filter hhf network scheduler when processing a device with a very large Maximum Transmission Unit MTU. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit...

CVE-2026-90061

A flaw was found in the netfilter nftables component of the Linux kernel. When new elements are inserted into a set without providing override expressions, a double cloning of existing set expressions occurs. This can lead to a module reference count imbalance, potentially causing system...

CVE-2026-90059

A flaw was found in the Linux kernel's stmmac network driver. The driver's receive RX path, after being converted to zero-copy, failed to correctly align IP packet headers. This misalignment, particularly on ARM32 architectures, can cause the system to panic when processing certain network packet...

CVE-2026-90055

A flaw was found in the Linux kernel's USB ATM Asynchronous Transfer Mode driver. An invalid initialization of the cirange fields, specifically vpibits and vcibits, to a negative sentinel value can lead to a shift-out-of-bounds error. This undefined behavior can be triggered by a local user...

CVE-2026-90053

A flaw was found in the Linux kernel's Hierarchical Token Bucket HTB scheduler. An unprivileged local user, by sending a specially crafted network packet, can trigger an infinite loop in the packet classification path. This can cause the system to soft lockup or panic, resulting in a Denial of...

CVE-2026-90051

A flaw was found in the Linux kernel's TCP networking component. A local attacker could craft a malicious iouring request with dmabufid and zero-copy flags, but without the necessary binding. This improper handling of non-zero-copy devmem transmit could lead to the breaking of internal data...

CVE-2026-90050

A flaw was found in the Linux kernel's Fair Queueing fq scheduler. A local attacker with network administration capabilities CAPNETADMIN could manipulate the quantum and initialquantum parameters. This manipulation allows overriding internal safeguards, potentially leading to a "small-quantum...

RLSA-2026:80663 Moderate: tftp security update

The Trivial File Transfer Protocol TFTP is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to...

Xenstore: Guests can crash xenstored during Live Update

ISSUE DESCRIPTION During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data. IMPACT An...

Arm: multiple issues with GNTTABOP_cache_flush

ISSUE DESCRIPTION 1 XSA-437 CVE-2023-34321 addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOPcacheflush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take...