CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

UBUNTU-CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74710 xsk: require at least 16 bytes of TX metadata

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

CVE-2026-74693 net: prestera: validate firmware header length

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

EUVD-2026-64585

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648

CVE-2026-74648 affects the rtl8723bs staging driver in the Linux kernel. The function rtw_cfg80211_monitor_if_xmit_entry() removes a radiotap header and then reads the 802.11 frame control field without verifying that a base 802.11 header remains. Additionally, the data path pulls the calculated ...

EUVD-2026-64535

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598

CVE-2026-74598 is an out-of-bounds read in the Linux kernel's IPv6 stack, specifically in rt6_route_rcv() handling of the Route Information option (RFC 4191). Both length checks are off by one: the code accepts length >= 2 and length >= 1 where RFC 4191 requires stricter bounds. A remote at...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

PT-2026-79603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the rt6 route rcv function incorrectly validates the length of the Route Information option RFC 4191 against the prefix length due to off-by-one...

PT-2026-79653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtl8723bs staging driver where the rtw cfg80211 monitor if xmit entry function removes the radiotap header and reads the 802.11 frame control field without verifyi...

Linux Distros Unpatched Vulnerability : CVE-2026-74648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control...

Linux Distros Unpatched Vulnerability : CVE-2026-74598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both chec...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102029)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102029 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a...

CVE-2026-18302 GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...