EUVD-2026-71249

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

EUVD-2026-71245

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

CVE-2026-80810 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

CVE-2026-80810

CVE-2026-80810 is an out-of-bounds write/read vulnerability in the Linux kernel's io_uring resource management subsystem. The root cause is an integer overflow in io_vec_fill_bvec(), which computes the folio size using a plain int 1 shifted by imu->folio_shift. When folio_shift is 32 or greate...

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

DEBIAN-CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

UBUNTU-CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-81666 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

EUVD-2026-70987

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-81666

CVE-2026-81666 affects the Corosync cluster communication library. The vulnerability resides in the check_memb_commit_token_sanity function, where an integer overflow in the expected message-length calculation on 32-bit systems bypasses the length-validation check for membership commit token mess...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-81666 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by IBM Tivoli System Automation for Multiplatforms. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the...

The vulnerability of the fastrpc_get_args() function in the drivers/misc/fastrpc.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fastrpcgetargs function in the drivers/misc/fastrpc.c module of the Linux kernel is related to the possibility of integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the `komeda_fb_afbc_size_check()` function in the `drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c` file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a hacker to access protected information or cause a service failure.

The vulnerability of the komedafbafbcsizecheck function in the drivers/gpu/drm/arm/display/komeda/komedaframebuffer.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux kernel, is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability...

The vulnerability of the dma_length() function in the drivers/accel/ethosu/ethosu_gem.c module of the Linux kernel’s acceleration device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dmalength function in the drivers/accel/ethosu/ethosugem.c module of the Linux kernel’s acceleration device driver lies in integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...