CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

DEBIAN-CVE-2026-89608

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

AZL-100184 CVE-2026-89608 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

AZL-100133 CVE-2026-89574 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

DEBIAN-CVE-2026-89574

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

DEBIAN-CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

AZL-100340 CVE-2026-89562 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

DEBIAN-CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89608

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

UBUNTU-CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-54135

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

EUVD-2026-76542

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

EUVD-2026-76520

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

CVE-2026-89608

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

CVE-2026-89608 ecryptfs: pass packet set buffer size to parser

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

CVE-2026-89608 ecryptfs: pass packet set buffer size to parser

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

EUVD-2026-76486

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...