CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

EUVD-2026-55588

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68373 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

EUVD-2026-55453

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

EUVD-2026-55417

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316

The CVE affects the Linux kernel accel: ethosu component. Two issues in command stream validation lead to undercounted element sizes for 16/32/64-bit elements and, for NHWC format, missing element size in the calculation. The element-size bitfield differs between IFM/IFM2 (bits 2:3) and OFM (bits...

CVE-2026-68262 drm/imagination: Fix user array stride in pvr_set_uobj_array()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

EUVD-2026-55363

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

CVE-2026-68262

CVE-2026-68262 affects the Linux kernel’s drm/imagination: pvr_set_uobj_array() mishandles the destination user array stride when copying kernel objects to userspace. The code previously advanced the userspace pointer by the kernel object size while advancing the kernel pointer by the userspace s...

CVE-2026-68197 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

CVE-2026-68190 staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

PT-2026-69802

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cfg80211 is element inherited function where the first data octet of a candidate element is read to check an extension non-inheritance list without verifying if th...

PT-2026-69716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the command stream validation of the ethosu accelerator where element size is incorrectly calculated when it is 16, 32, or 64 bits. This occurs because the element siz...

CVE-2026-68316: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

The vulnerabilities of the Ingress components and Custom Resource Definitions (CRDs) of the NGINX Ingress Controller platform allow a malicious actor to insert arbitrary configuration directives into NGINX, gain unauthorized access to file creation and deletion operations, or trigger service failures.

The vulnerability of the Ingress components and Custom Resource Definitions CRDs of the NGINX Ingress Controller monitoring and management platform is related to the lack of measures taken to neutralize special elements during the processing of string values. Exploiting this vulnerability allows ...

CVE-2026-33817

Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to...

CVE-2026-48007

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

CVE-2026-48007 Element Call reports full URLs of visited pages to analytics server

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

CVE-2026-48007

Element Call versions 0.5.17–0.19.3 report analytics data to a PostHog server, and several fields ($initial_person_info, $session_entry_url, $current_url) include the full visited URL (including fragments), potentially exposing encryption passwords to anyone with analytics access. The issue affec...