CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

CVE-2026-11748

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:28+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75 2026-09-12 04:32:07+00:00| seen| https://gist.github.com/alon710/c05d2b733514467507b538dab5375550...

CVE-2026-56828

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:14+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3...

CVE-2026-56829

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:09+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f...

CVE-2026-80931

A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, leading to an out-of-bounds read of up to 222 bytes. This...

CVE-2026-90460

creationtimestamp| type| source ---|---|--- 2026-09-11 21:50:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3aweqrn5ditaf 2026-09-12 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mvc3nml2g724 2026-09-12 03:00:28+00:00| seen|...

CVE-2026-89481

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...

CVE-2026-80961

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker with CAPSYSADMIN capabilities could exploit unbounded fields decoded from the cache device. This could lead to an out-of-bounds read, potentially disclosing sensitive information from adjacent persistent memory to...

UBUNTU-CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

AZL-100637 CVE-2026-89674 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

AZL-100667 CVE-2026-89650 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

AZL-100496 CVE-2026-89631 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

DEBIAN-CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

DEBIAN-CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...