CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-64126

The CVE-2026-64126 entry concerns the Linux kernel Bluetooth MGMT path for Add Extended Advertising Data. A vulnerability exists where MGMT_OP_ADD_EXT_ADV_DATA is a variable-length command and the fixed-header size plus advertised data lengths are not validated against cp->data, allowing an ou...

CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

EUVD-2026-45658

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 bounce blackbox records through a protocol-sized buffer adm1266pmbusblockxfer copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpydatar, &msgs1.buf...

CVE-2026-63985

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...

CVE-2026-63920 ipv6: validate extension header length before copying to cmsg

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-63903

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

CVE-2026-63903

The CVE-2026-63903 entry concerns the Linux kernel USB-serial Belkin sa driver. The vulnerability arises from belkin_sa_read_int_callback() treating the interrupt data as a four-byte status report and reading LSR/MSR fields from offsets 2 and 3, with the interrupt-in buffer length derived from en...

CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

PT-2026-61443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth MGMT component where the MGMT OP ADD EXT ADV DATA command fails to verify if the specified advertising data lengths are within the actual command payload...

PT-2026-61237

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unprivileged slab-out-of-bounds read exists in the Linux kernel. The ip6 datagram recv specific ctl function trusts the on-wire hdrlen byte when computing the length for put cmsg, but...

PT-2026-61402

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hwmon subsystem where the adm1266 pmbus block xfer function copies a device-supplied block payload into a caller-provided buffer using a length specified by the...

PT-2026-61431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv4 raw socket implementation where the raw send hdrinc function fails to reject packets with an Internet Header Length ihl value of less than 5. According to RFC...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding bsc1208300. CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header...

SUSE-SU-2026:3057-1 Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues - CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding bsc1208300. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header...

Security update for glibc

This update for glibc fixes the following issues CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write bsc1263656. CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure bsc1263658. Patch...

Oracle Linux 10 : postgresql18 (ELSA-2026-19009)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19009 advisory. - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005:...

CVE-2026-15711

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...