UBUNTU-CVE-2026-68289

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipcrecvmsg and tipcrecvstream In tipcrecvmsg, the copy length is computed as: copy = mintint, dlen - offset, buflen; buflen is sizet but mintint, ... casts it to int. When buflen exceeds INTMAX e.g...

CVE-2026-68270

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

UBUNTU-CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

UBUNTU-CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

UBUNTU-CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

SUSE-SU-2026:3542-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

SUSE-SU-2026:3541-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. - CVE-2026-58050: heap buffer...

UBUNTU-CVE-2026-59088

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...

CVE-2026-59088

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...

CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68315 sctp: validate stream count in sctp_process_strreset_inreq()

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

EUVD-2026-55390

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipcrecvmsg and tipcrecvstream In tipcrecvmsg, the copy length is computed as: copy = mintint, dlen - offset, buflen; buflen is sizet but mintint, ... casts it to int. When buflen exceeds INTMAX e.g...

CVE-2026-68289 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipcrecvmsg and tipcrecvstream In tipcrecvmsg, the copy length is computed as: copy = mintint, dlen - offset, buflen; buflen is sizet but mintint, ... casts it to int. When buflen exceeds INTMAX e.g...

CVE-2026-68289 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipcrecvmsg and tipcrecvstream In tipcrecvmsg, the copy length is computed as: copy = mintint, dlen - offset, buflen; buflen is sizet but mintint, ... casts it to int. When buflen exceeds INTMAX e.g...

CVE-2026-68270 drm/sysfb: Avoid possible truncation with calculating visible size

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

CVE-2026-68257

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

CVE-2026-68257 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

CVE-2026-68108 drm/amdgpu/vce: fix integer overflow in image size

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...