UBUNTU-CVE-2026-68164

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

UBUNTU-CVE-2026-68258

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

CVE-2026-68164

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68406 wifi: cfg80211: validate PMSR FTM preamble range

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...

CVE-2026-68353 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68343

CVE-2026-68343 affects the Linux kernel SMB client. A malformed DFS referral can cause PathConsumed to exceed the search name, enabling out-of-bounds DFS path parsing. The root cause is in parse_dfs_referrals where PathConsumed is not validated against the search name length before storage. The f...

CVE-2026-68343 smb: client: validate DFS referral PathConsumed

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a...

CVE-2026-68340 hwmon: occ: validate poll response sensor blocks

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

EUVD-2026-55487

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68097 ksmbd: validate ACE size against SID sub-authorities

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in...

SUSE-SU-2026:3537-1 Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. - CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution...

CVE-2026-21083

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-21070

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21066

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

Improper Input Validation

Apache Camel IRC component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of IRC control headers, where attacker-controlled irc. headers from untrusted HTTP requests can override the intended message destination, allowing unauthorized message...