CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89588

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89586 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

EUVD-2026-76482

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

EUVD-2026-76473

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89562 ip6_gre: fix hardware header length for NBMA tunnels

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89562

This Linux kernel vulnerability affects the ip6_gre (IPv6 Generic Routing Encapsulation) module, specifically ip6gre_tnl_link_config_route(), which incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA (Non-Broadcast Multiple Access) tunnels. The ...

CVE-2026-89562 ip6_gre: fix hardware header length for NBMA tunnels

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

CVE-2026-89551

CVE-2026-89551 is a CRITICAL (CVSS 9.8) integer underflow in the Linux kernel's SUNRPC subsystem. The xdr_buf_trim() function subtracts consumed bytes from buf->len without clamping, so when called from gss_krb5_unwrap_v2() with a small wire-derived buf->len while page-scale iov_lens are pr...

CVE-2026-89550 SUNRPC: svcauth_gss: enforce krb5 token minimum length

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

EUVD-2026-76461

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

CVE-2026-89541 SUNRPC: harden gss_unwrap_resp_priv length checks

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89541

A u32 integer overflow in the Linux kernel's SUNRPC component, specifically in gss_unwrap_resp_priv(), allows a malicious krb5p NFS server to send a crafted RPCSEC_GSS reply that bypasses the opaque-length bound check. When opaque_len is near 0xffffffff, the sum offset + opaque_len wraps, passing...

CVE-2026-89537 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...