PT-2026-94424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq init function where quantum and initial quantum are computed using psched mtu without overflow checks. When a device has an excessively large Maximum Transmissi...

CVE-2026-93395: Integer Underflow (Wrap or Wraparound)

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

PT-2026-95112

Name of the Vulnerable Software and Affected Versions libbson affected versions not specified Description An integer underflow occurs in the bson new from buffer function when processing BSON data with a zero-length prefix. The function fails to verify that the 32-bit document length read from th...

CVE-2026-90200: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-54571: Integer Overflow or Wraparound

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores boundaryPosition as an 8-bit value while parseMultipartPostByte processes the boundary. A remote request...

CVE-2026-76834: Deserialization of Untrusted Data

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in paramcheckserializedarray fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST...

CVE-2026-90246: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

PT-2026-94594

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the AppArmor module during the validation of the tagset table unpacked from a policy blob. The verify tags function performs a bounds check by adding an ind...

libsoup3 security update

3.6.5-14 - Fix CVE-2026-85197: http2 crash after connection destroyed 3.6.5-13 - Fix CVE-2026-15711: Reject oversized WebSocket control frames 3.6.5-12 - Fix CVE-2026-15709: bound decompressed WebSocket message size 3.6.5-11 - Add patches for CVE-2026-4271 and CVE-2026-5119 3.6.5-10 - Add patch f...

PT-2026-94367

Name of the Vulnerable Software and Affected Versions b2evolution CMS versions 6.7.8 through 7.2.5 Description An incomplete fix in the param check serialized array function fails to reject payloads containing negative integer array keys. Unauthenticated attackers can send crafted serialized PHP...

CVE-2026-90199: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

CVE-2026-90136: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

CVE-2026-90141: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...

CVE-2026-90063: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

CVE-2026-90076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

PT-2026-94411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio-net component where a user can specify an arbitrary gso size in a packet crafted with an AF PACKET PACKET VNET HDR socket. If the gso size is set to a value...

PT-2026-94489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the IPVS FTP helper during port and address parsing. The function ip vs ftp get addrport accumulates decimal digits into a u16 hport and an unsigned char p...

PT-2026-94544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC SOF component where topology mixer minimum and maximum values are treated as non-negative indices for the volume table. These values are stored in signed...

PT-2026-94548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the ntfs init from boot function within the ntfs3 file system. The issue occurs during the validation of Master File Table MFT cluster numbers read from the...

PT-2026-94720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow occurs in the mt7915 mcu get sta nss function within the mt76 wifi driver. When a peer's VHT/HE MCS map contains no supported spatial streams, the loop terminates wi...