CVE-2026-68479

CVE-2026-68479 affects the Linux kernel Bluetooth stack, specifically the btrtl driver. The vulnerability stems from rtlbt_parse_firmware() copying patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can cause an underflow, turni...

CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

EUVD-2026-59101

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

EUVD-2026-59080

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

MINI-7P8J-CXXJ-MMC8

Bulletin has no description...

PT-2026-72191

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt parse firmware copies patch length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction...

PT-2026-73022

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs rl realloc and ntfs rl realloc nofail...

OPENSUSE-SU-2026:11515-1 ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-73193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse...

Linux Distros Unpatched Vulnerability : CVE-2026-72367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so th...

PT-2026-72294

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset size overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to region count overflow" made sure that region count could fit in an unsigned int. But the bitmap memory isn't allocat...

PT-2026-72222

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill from part fill from part computes the size of a directory entry in size t but stores it in a u32. An entry length near U32 MAX wraps it to a small value, bypasses the bounds...

PT-2026-72486

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr endpoint post qrtr endpoint post validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, size t is 32 bits and...

PT-2026-72257

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in update rlimit cpu update rlimit cpu converts the RLIMIT CPU value to nanoseconds with u64 nsecs = rlim new NSEC PER SEC; On 32-bit kernels both rlim new unsigned long and NSEC PER SEC...

PT-2026-72890

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...

PT-2026-72830

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm buf-len is a user-controlled uint32 t received from the network. Adding it to imm data offset without overflow checking allows a malicious initiator to send...

PT-2026-72853

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon align pitch radeon align pitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed...

PT-2026-72797

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdp idx when it equals n i.e. NUMFDPC + 1...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...