160 matches found
CVE-2026-80876
A flaw was found in the Linux kernel's ring-buffer component. When 8-byte alignment is enforced, the system incorrectly calculates the length of small events. This error causes these events to report a data length that is 4 bytes larger than their actual size. This discrepancy can lead to...
CVE-2026-97954
A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. This vulnerability allows a network user to cause a Denial of Service DoS by corrupting TCP communication streams. On systems configured with memory page sizes larger than 8 KB, the kernel incorrectly calculates buffe...
SUSE CVE-2026-90259
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
Linux Distros Unpatched Vulnerability : CVE-2026-90259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But...
DEBIAN-CVE-2026-90259
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
AZL-102108 CVE-2026-90259 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
CVE-2026-90259
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
AZL-102536 CVE-2026-90078 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...
CVE-2026-90259
CVE-2026-90259 affects the btrfs qgroup subsystem of the Linux kernel . The bug is in qgroup_free_reserved_data(), where the length calculation incorrectly uses round_up(start + len, sectorsize)—yielding the rounded-up end position rather than the rounded-up length . This produces an erroneously ...
CVE-2026-90259 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
EUVD-2026-81852
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
CVE-2026-90259 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
EUVD-2026-81939
In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...
PT-2026-94607
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs qgroup component where the qgroup free reserved data function performs an incorrect length calculation. The function rounds down the start position and round...
CVE-2026-90259: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...
Astra Linux – Vulnerability in u-boot
A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with an unvalidated length at nfsreadlinkreply in the “else” block, after calculating the new path length...
SUSE CVE-2026-63939
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...
CVE-2026-63939 KVM: SEV: Compute the correct max length of the in-GHCB scratch area
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...
kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackh323 module. This vulnerability occurs in the DecodeQ931 function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value...
GHSA-5PMV-RX8R-WMV5 jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...