CVE-2026-63987 ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

CVE-2026-63987

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

CVE-2026-63987

Summary: CVE-2026-63987 affects the Linux kernel’s ethtool/ethnl path. The issue arises in ethnl_update_profile(): it iterates a nested Netlink list with index i and writes new_profile[i++] without bounding i. The destination is kmemdup()’d at NET_DIM_PARAMS_NUM_PROFILES entries (5), while Netlin...

CVE-2026-63917

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6test netns ns2 ip -n ns2 link set vti6test type vti6 remote ::3...

CVE-2026-63917

The CVE-2026-63917 entry describes a Linux kernel issue in vti6 where changing network namespaces (NETNS) after a tunnel is created can leave a stale netns reference, due to NETIF_F_NETNS_LOCAL being dropped from vti6 devices by commit 61220ab34948. This allows a vti6 tunnel to move across namesp...

CVE-2026-63909

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smbcheckpermdacl ACE-walk loops Commit d07b26f39246 "ksmbd: require minimum ACE size in smbcheckpermdacl" introduced a transposed bounds check: if offsetofstruct smbace, sid + acessize size offset 2...

CVE-2026-63891

The CVE affects the Linux kernel Thunderbolt property parser. A crafted peer can trigger a back‑reference loop in DIRECTORY entries, exhausting stack via __tb_property_parse_dir() because the value is used as dir_offset without a depth counter. The fix threads a depth counter through tb_property_...

CVE-2026-63878

The CVE-2026-63878 entry concerns the Linux kernel driver drm/amdgpu, specifically GEM_OP GET_MAPPING_INFO. The issue arises when user-supplied num_entries is used directly to allocate memory via kvcalloc without an upper bound, with num_entries as __u32 and each entry-sized 32 bytes. This can le...

CVE-2026-63878 drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

EUVD-2026-45763

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

CVE-2026-63878 drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

CVE-2026-63878

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

CVE-2026-63814

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fsaclfromdisk f2fsaclcount only validates the aggregate ACL xattr length. A malformed ACL can still place ACLUSER or ACLGROUP in a slot that only contains struct f2fsaclentryshort bytes, and...

CVE-2026-63802 blk-cgroup: fix UAF in __blkcg_rstat_flush()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

CVE-2026-53374

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpubocreatekernel does not zero-initialize the buffer, when a single PTE is written the TLB may speculativel...

CVE-2026-53368

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The...

PT-2026-61130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer over-read exists in the f2fs implementation of the Linux kernel. The f2fs acl count function only validates the aggregate ACL xattr length, allowing a malformed ACL to place ACL...

PT-2026-61118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the blk-cgroup component. This occurs when multiple blkg structures within the same blkcg are released concurrently. A race condition arises when the blk...

Linux Distros Unpatched Vulnerability : CVE-2026-53374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpubocreatekernel does not...

EUVD-2026-45326

OpenMcdf is a fully .NET / C library to manipulate Compound File Binary File Format files, also known as Structured Storage. In 3.1.3 and earlier, the BST name-lookup loop in DirectoryTree.TryGetDirectoryEntry OpenMcdf/DirectoryTree.cs:35-46 walks directory entries by repeatedly calling...