CVE-2026-98095

A flaw in the Linux kernel 's af_packet network subsystem allows a local user to trigger a Denial of Service (DoS) . The vulnerability occurs because tpacket_parse_header() improperly casts user-provided tpacket_hdr.tp_len (a u32 ) to a signed int . If the length exceeds INT_MAX , the resulting n...

CVE-2026-98095 af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader. syzbot reported BUG in socksendmsgnosec. 0 The problem is that tpacketparseheader casts user-provided tpackethdr.tplen, which is u32, to int. If the length is...

CVE-2026-98095

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader. syzbot reported BUG in socksendmsgnosec. 0 The problem is that tpacketparseheader casts user-provided tpackethdr.tplen, which is u32, to int. If the length is...

CVE-2026-97990 vdpa_sim_net: check TX pull result before RX copy

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97990

The Linux kernel is vulnerable in the vdpa_sim_net component due to an improper check of the vringh_iov_pull_iotlb() return value. Because the function returns a signed byte count, a failed TX pull results in a negative error that is incorrectly added to an unsigned byte counter. This value is th...

EUVD-2026-86644

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97990 vdpa_sim_net: check TX pull result before RX copy

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97906

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906

The Linux kernel is affected by an integer overflow vulnerability within the get_boot_config_from_initrd() function. A crafted initrd with an excessively large bootconfig size (e.g., 0xFFFFFFFF) causes pointer arithmetic to wrap around, specifically when calculating data = ((void *)hdr) - size. T...

EUVD-2026-86760

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97559

The Linux kernel contains a vulnerability in the SMB client where the functions replace_sids_and_copy_aces() and set_chmod_dacl() incorrectly use a u16 accumulator to track DACL size. This causes an integer wraparound when the rewritten DACL exceeds 64K (specifically reaching a wraparound with 86...

CVE-2026-97559 smb: client: fail DACL rewrite when the new DACL exceeds 64K

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97551

The Linux kernel 's xfs filesystem contains a vulnerability where xfs_parent_da_args_init() initializes xfs_parent_args with a zeroed value, leaving args->total at 0. During attribute fork growth, xfs_da_grow_inode_int() treats this as a running block reservation; because it is an xfs_extlen_t...

EUVD-2026-86859

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

OPENSUSE-SU-2026:21988-1 Security update for radare2

This update for radare2 fixes the following issues: Changes in radare2: - Update to version 6.2.2: Analysis: new JNI plugin with typed interface tables, arm64 Swift float calling conventions, DWARF prototype linking, jump-table and switch-case fixes Core: fix RAnalOp leaks in disasm/diff/debug...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists in the calculation of a memory allocation size. When processing large input values, this calculation can result in an undersized memory region, which can then be overrun by firmware. This could...