CVE-2026-68479

CVE-2026-68479 affects the Linux kernel Bluetooth stack, specifically the btrtl driver. The vulnerability stems from rtlbt_parse_firmware() copying patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can cause an underflow, turni...

CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

EUVD-2026-59101

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

EUVD-2026-59080

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

MINI-7P8J-CXXJ-MMC8

Bulletin has no description...

CVE-2026-74297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

PT-2026-72853

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the radeon align pitch function. The issue occurs during the alignment round-up addition and the final calculation of aligned cpp, both of which can overflo...

PT-2026-72797

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NVMe driver regarding the Flexible Data Placement FDP bounds check. The system incorrectly validates the fdp idx variable by using a greater-than operator instead ...

PT-2026-72486

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A 32-bit integer overflow exists in the qrtr endpoint post function. The issue occurs during the validation of incoming packets where the size variable, received from the wire, is...

PT-2026-72514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CAKE Common Applications Kept Enhanced queuing discipline where signed overhead values are stored in an s16 type, but the adjusted packet length calculation utiliz...

PT-2026-72191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the rtlbt parse firmware function fails to properly validate firmware patch bounds. When processing a malformed firmware patch shorter th...

PT-2026-72222

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the orangefs component. The fill from part function calculates the size of a directory entry using size t but stores the result in a u32 variable. If an...

PT-2026-72257

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the update rlimit cpu function where the RLIMIT CPU value is converted to nanoseconds using 32-bit multiplication on 32-bit kernels. Because both rlim new and NSEC PER...

PT-2026-72294

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the dm-log component on 32-bit architectures. The issue arises during the calculation of the bitset size variable, which is used for bitmap memory allocatio...

PT-2026-73022

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs rl realloc and ntfs rl realloc nofail...

OPENSUSE-SU-2026:11515-1 ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76452

These are all security issues fixed in the libs2n1-1.7.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76441

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-72298: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...