SUSE CVE-2026-98916

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link...

CVE-2026-98833

A flaw was found in the Linux kernel's Memory Technology Device MTD subsystem. When accessing certain partitions, the kernel improperly passes a partition device reference instead of the master device structure to the driver callback. A local user could exploit this flaw during device access...

CVE-2026-98916

The Linux kernel contains a vulnerability within the wifi: nl80211 component. The root cause is a failure to validate that a link is beaconing before attempting a color change , which can lead to the system calling a driver with an invalid link . The vulnerability has been resolved by implementin...

CVE-2026-98916 wifi: nl80211: check link is beaconing for color change

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link...

CVE-2026-98727

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device reports a zone size of zero, subsequent read or write...

SUSE CVE-2026-98806

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

CLEANSTART-2026-QZ41346 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CVE-2026-98659

A flaw was found in the Linux kernel's ROHM BM1390 Industrial I/O IIO sensor driver. The driver fails to propagate error status codes when a read operation fails, unconditionally returning success. A local user querying the sensor can receive invalid or uninitialized measurement data without an...

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

GHSA-J4M9-6W36-PW47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

CVE-2026-98636

A flaw was found in the SquashFS file system implementation in the Linux kernel. A local user could exploit this vulnerability by mounting a specially crafted SquashFS image with an invalid dictionary size. Processing this image triggers an invalid shift operation, leading to a kernel crash and...

CVE-2026-98630

A flaw was found in the Linux kernel's fbnic network driver. When memory allocation for a payload page pool fails, the error cleanup routine incorrectly attempts to destroy an invalid error pointer instead of releasing the allocated header page pool. A local user able to trigger interface queue...

CVE-2026-109618

out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid...

CVE-2020-37288

Vyper versions 0.1.0b10 before 0.2.3 are vulnerable to an invalid jump destination caused by a stack underflow . This occurs when a return statement is used inside a for loop within an internal function that is called two or more internal calls deep. The compiler generates incorrect code for thes...

CVE-2020-37288 Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

CVE-2020-37288 Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

CVE-2026-80913

A flaw was found in the Linux kernel's SELinux subsystem. An attacker with local access could exploit this by providing a specially crafted SELinux policy. This policy, containing an incorrect number of defined boolean values, would cause the kernel to attempt to access an invalid memory location...

perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting

A flaw was found in perl-DBI. When casting numeric values to the SQLNUMERIC type using the sqltypecast function, the component incorrectly handles numeric values as strings without converting them first. An attacker capable of supplying numeric input to an affected application can trigger an...

Linux Distros Unpatched Vulnerability : CVE-2026-98572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This...

Linux Distros Unpatched Vulnerability : CVE-2026-98806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For S...