CVE-2026-89557

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb-bblogshift in super1load In super1load, sb-bblogshift is an u8 type value loaded from on- disk superblock. It is used for badblocks API badblocksset by the following sequence, 1930 rdev-badblocks.shif...

CVE-2026-89541 SUNRPC: harden gss_unwrap_resp_priv length checks

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

EUVD-2026-76452

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89541

A u32 integer overflow in the Linux kernel's SUNRPC component, specifically in gss_unwrap_resp_priv(), allows a malicious krb5p NFS server to send a crafted RPCSEC_GSS reply that bypasses the opaque-length bound check. When opaque_len is near 0xffffffff, the sum offset + opaque_len wraps, passing...

CVE-2026-89541 SUNRPC: harden gss_unwrap_resp_priv length checks

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89513

CVE-2026-89513 is an integer overflow in the Linux kernel's KVM (RISC-V) component. The SBI PMU EVENT_GET_INFO handler stores num_events * sizeof(*einfo) in a 32-bit integer; on RV64, a guest-supplied num_events = 0x10000001 truncates the allocation to 16 bytes while KVM still loops over the orig...

CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

EUVD-2026-76419

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

CVE-2026-81000

CVE-2026-81000 affects the Linux kernel TUN/TAP driver . The root cause is an integer underflow in tun_get_user(): when Open vSwitch (OVS) propagates an oversized headroom request from another port, SKB_MAX_HEAD(align) underflows, causing tun_alloc_skb() to place skb->data outside the allocate...

DEBIAN-CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

UBUNTU-CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

EUVD-2026-76113

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

CVE-2026-87020 Orthanc DICOM Server Integer Overflow or Wraparound

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...

CVE-2026-87020

Orthanc DICOM Server (headquartered in Belgium, deployed worldwide in the healthcare sector) is vulnerable to an integer overflow in its pitch and buffer-size computation when decoding an attacker-supplied PNG or JPEG image. This leads to a heap out-of-bounds write , resulting in a process crash ...

CVE-2026-87643

A flaw was found in Google Chrome. An integer overflow vulnerability exists in the Graphics Processing Unit GPU. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the browser's securit...

CVE-2026-89158

A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the pcre2compile32 function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denia...