UBUNTU-CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74651

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74710

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

CVE-2026-74701 net/openvswitch: check Ethernet header length in key_extract()

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

EUVD-2026-64388

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

CVE-2026-74701

This vulnerability affects the Open vSwitch (OVS) component of the Linux kernel in key_extract() within net/openvswitch/flow.c. When a packet with the ETH_P_TEB protocol arrives on an ARPHRD_NONE device (e.g., TUN), the function unconditionally pulls Ethernet header bytes (MAC addresses and ether...

CVE-2026-74701 net/openvswitch: check Ethernet header length in key_extract()

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

EUVD-2026-64368

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681 usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651

CVE-2026-74651 is an out-of-bounds read in the Linux kernel's rtl8723bs Wi-Fi driver (staging). The function rtw_get_wpa_ie() reads a 4-byte OUI+type and a 2-byte version word at fixed offsets into a vendor-specific information element (EID 221) without verifying the IE body is at least 6 bytes l...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

Linux Distros Unpatched Vulnerability : CVE-2026-74649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's...

PT-2026-79655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the WMM param handler function within the rtl8723bs staging driver. The function copies a fixed-size WMM parameter element from a received information...

Linux Distros Unpatched Vulnerability : CVE-2026-74681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it...