5391 matches found
PT-2026-72922
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi debug: Fix REPORT ZONES alloc len underflow OOB write resp report zones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc len up with ALIGN before deriving the descriptor count: rep max zon...
PT-2026-72718
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt unacked underflow on CONN ACK tipc sk conn proto rcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt unacked without checking that it does not exceed the number of...
PT-2026-72318
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet rdma use inline sg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...
Linux Distros Unpatched Vulnerability : CVE-2026-72225
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jbd2: fix integer underflow in jbd2journalinitializefastcommit jbd2journalinitializefastcommit validates journal capacity by checking journal-jlast - numfcblks...
Linux Distros Unpatched Vulnerability : CVE-2026-72382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit i...
PT-2026-72413
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2 journal initialize fast commit jbd2 journal initialize fast commit validates journal capacity by checking journal-j last - num fc blks JBD2 MIN JOURNAL BLOCKS. Both j last and num fc blks are...
PT-2026-72705
In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test xdp native adjst head grow data crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxt rx multi page skb, which...
PT-2026-72570
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse dacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...
PT-2026-72379
In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indx insert into buffer indx insert into buffer computes used = used1 - to copy - sp size; memmovede t, Add2Ptrsp, sp size, used - le32 to cpuhdr1-de off; where sp and sp size come from hdr...
Linux Distros Unpatched Vulnerability : CVE-2026-74499
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill- loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a...
PT-2026-72896
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...
SUSE CVE-2026-16241
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...
CVE-2026-45699
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-45699
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-45699 Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-45699
CVE-2026-45699 affects Netatalk (afpd) on Unix-like systems, with vulnerable versions 3.1.19–4.4.2. A stack-based buffer overflow arises in copydir() due to an integer underflow when calculating remaining buffer space for path construction, causing boundary checks against de->d_name to pass an...
EUVD-2026-58790
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-45699 Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-45699
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
