kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

CVE-2026-93784: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

EUVD-2026-86318

Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4AvccAtom::Create and AP4HvccAtom::Create. A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value...

Linux Distros Unpatched Vulnerability : CVE-2026-93783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without...

Linux Distros Unpatched Vulnerability : CVE-2026-93784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie...

CVE-2026-88377

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4ATOMHEADERSIZE can cause AP4AvccAtom::Create or AP4HvccAtom::Create to underflow the payload-size...

CVE-2026-88377

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4ATOMHEADERSIZE can cause AP4AvccAtom::Create or AP4HvccAtom::Create to underflow the payload-size...

PT-2026-97984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where a malformed Information Element IE buffer can be stored via the SIOCSIWGENIE command in the cfg80211 wext siwgenie function without proper validation. A subsequent...

PT-2026-104887

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211 wext siwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211 wext siwgenie without any validation. The crash trace shows that a subsequent...

PT-2026-104940

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process read and process write usr len is read from a network-supplied message field le16 to cpu and used to compute data len = off - usr len without validating that usr len off causing an...

CVE-2026-93783: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

PT-2026-98115

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds memory exposure exists in the get wave state function for v9. The function trusts cp hqd cntl stack size and cp hqd cntl stack offset values read from the MQD, which can...

Linux Distros Unpatched Vulnerability : CVE-2026-97413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network- supplied message field le16tocpu and used to compute datalen...

CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

CVE-2026-93784

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

PT-2026-98149

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0.0 Description An integer underflow exists in the avcC and hvcC configuration atom parsers. When processing a specially crafted MP4 file where an atom has a declared size smaller than AP4 ATOM HEADER SIZE, the functions AP4...