CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651

CVE-2026-74651 is an out-of-bounds read in the Linux kernel's rtl8723bs Wi-Fi driver (staging). The function rtw_get_wpa_ie() reads a 4-byte OUI+type and a 2-byte version word at fixed offsets into a vendor-specific information element (EID 221) without verifying the IE body is at least 6 bytes l...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

Linux Distros Unpatched Vulnerability : CVE-2026-74649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's...

PT-2026-79655

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM param handler WMM param handler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds re...

PT-2026-79698

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera fw hdr parse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera fw header before decoding the...

PT-2026-79686

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf len against rxbuf len in bulk msg ibuf len is the bulk IN receive buffer size, but the EMSGSIZE check in usbio bulk msg compares it against txbuf len — the bulk OUT endpoint size. Both are taken...

PT-2026-79676

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr verify The digest-length check in xattr verify mixes int and size t: if xattr len - sizeofxattr value-type - hash start = iint-ima hash-length sizeof yields size t, so the usual arithmetic...

Linux Distros Unpatched Vulnerability : CVE-2026-74681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it...

CVE-2026-26081

A flaw was found in HAProxy. This vulnerability, stemming from a missing length check in the NEWTOKEN format, could allow a remote attacker to cause a low impact on data integrity and availability. This means an attacker might be able to subtly alter data or temporarily disrupt the service...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

EUVD-2026-62363

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-68765

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module module 34301 that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the nint...

EUVD-2026-59126

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

CVE-2026-68471

The CVE-2026-68471 entry describes a Linux kernel Wi-Fi (ieee80211) vulnerability in MLE length validation. The root cause is that ieee80211_mle_common_size() used the first common-info octet as the length for all MLE types, while ieee80211_mle_size_ok() only validated that octet for Basic, Probe...

RLSA-2026:53329 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cxl/port: Fix use after free of parentport in cxldetachep CVE-2026-31530 kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 kernel:...