CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

UBUNTU-CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

UBUNTU-CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

EUVD-2026-108729

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99063

The Linux kernel contains a vulnerability in the dm ioctl handling where the get_result_buffer() function fails to verify the buffer size relative to the struct dm_ioctl trailing padding. This allows data_start to point seven bytes past the end of the buffer, leading to a slab-out-of-bounds read ...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

DEBIAN-CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

UBUNTU-CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935

The Linux kernel is affected by an information leak vulnerability within the RTC (Real Time Clock) subsystem. Specifically, the struct rtc_wkalrm contains padding holes following the 'pending' member. When this structure is returned to userspace via the RTC_WKALRM_RD ioctl , uninitialized kernel ...

CVE-2026-98872 freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98872 freevxfs: don't BUG() on unknown typed-extent type

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

EUVD-2026-108718

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

CVE-2026-98872

The Linux kernel contains a vulnerability in the freevxfs file system where the vxfs_bmap_typed() function calls BUG() when encountering an unknown typed-extent type. This can cause a kernel crash when processing an on-disk typed extent with an unexpected value. The flaw is reachable via the ioct...

PT-2026-122040

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data start run past the buffer struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dm ioctl, data, is seven bytes shorter than sizeofstru...