ROS-20260911-73-0211

The vulnerability of the Redis database management system is related to integer overflow. Exploiting this vulnerability can allow an attacker to trigger a service failure using the commands HRANDFIELD and ZRANDMEMBE...

CVE-2026-89157: Integer Overflow or Wraparound

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

CVE-2026-89158: Integer Overflow or Wraparound

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

CVE-2026-89157: Integer Overflow or Wraparound

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

Linux Distros Unpatched Vulnerability : CVE-2026-89158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of- bounds write. CVE-2026-89158 Note that Nessus relies on the...

PT-2026-90273

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow issue exists in the super 1 load function. The variable sb-bblog shift, which is an u8 type value loaded from the on-disk superblock, is used to shift the sector and...

PT-2026-96503

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl cfg80211 connect event subtracts fixed IE offsets from assoc req len -= 4 and assoc resp len -= 6, both u8, with no lower bound. The aggregat...

PT-2026-96576

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-89592: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

CVE-2026-89559: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...

PT-2026-90527

Name of the Vulnerable Software and Affected Versions stb vorbis versions prior to 1.23 Description A heap buffer overflow occurs in the start decoder function due to the truncation of the codebook multiplicands allocation size from size t to int. An attacker can exploit this by providing a...

CVE-2026-54241: Heap-based Buffer Overflow

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an...

PT-2026-90356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An underflow of the loff t type occurs in the cifs remap file range function when the len variable is 0. This happens because the effective length is calculated as len = src inode-i size...

PT-2026-90248

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the pcl for each segment macro incorrectly calculates the upper bound when a parsed chunk list contains a chunk with a ch segcount of zero...

CVE-2026-89665: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

CVE-2026-81000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

PT-2026-90381

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFSv2 sattr decoder within the svcxdr decode sattr function. When processing SETATTR or CREATE requests, the decoder converts microseconds to nanoseconds. On ILP32...

PT-2026-90257

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss unwrap resp priv function improperly validates the RPCSEC GSS opaque length. Because the sum of offset and opaque len is computed...

CVE-2026-89541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

PT-2026-96441

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr decode sattr: iap-ia atime.tv nsec = tmp2 NSEC PER USEC; tmp2 is a u32 and NSEC PER USEC is...