CVE-2026-98621

The Linux kernel contains a vulnerability where the REMCSUM option can cause an integer underflow . The gue_remcsum() function passes an absolute checksum start and field offset to skb_remcsum_process(), which calculates the difference and stores it in a u16 variable. If the offset is less than t...

CVE-2026-98621 net: gue: reject invalid REMCSUM offsets

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98591

The Linux kernel contains a vulnerability in the skb_pointer_if_linear() function used by skb-backed BPF dynptr code. The root cause is an unsigned subtraction underflow occurring between skb_headlen and the off parameter. This flaw allows the bounds check to spuriously pass, potentially generati...

CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

CVE-2026-98446

The Linux kernel contains a vulnerability in the xfs filesystem. Specifically, within xfs_metafile_resv_init , if the reservable fdblocks for a metadata btree file falls below the space already used by that file, a hidden_space subtraction can underflow . This underflow causes xfs_dec_fdblocks to...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

EUVD-2026-103686

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

DEBIAN-CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

UBUNTU-CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

EUVD-2026-103463

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in streamheader in MPEGsystem.cpp that allows attackers to wrap packetsize by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEGnew, SMPEGnewrwops or SMPEGnewdata to trigger a reachable...

CVE-2026-112010

The smpeg library (versions through 2.0.0 ) is vulnerable to an integer underflow in the stream_header() function within MPEGsystem.cpp. An attacker can supply a crafted MPEG file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data to wrap the packet_size by declaring an undersized packet length. T...