CVE-2026-80717

CVE-2026-80717 is an information disclosure vulnerability in the Linux kernel SCTP subsystem. The root cause is that sctp_verify_param() accepts a header-only Adaptation Layer Indication parameter because the generic parameter walker only checks for header presence. sctp_process_param() then read...

CVE-2026-80573

A flaw was found in the Linux kernel's iforce driver, which handles input devices such as joysticks and wheels. This vulnerability occurs because the iforceprocesspacket function processes incoming data packets without adequately validating their lengths. A local attacker could exploit this by...

RockyLinux 8 : kernel (RLSA-2026:59821)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59821 advisory. kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode...

AZL-97707 CVE-2026-80573 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

UBUNTU-CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

CVE-2026-13480

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

Improper Tag-Length Validation

Bouncy Castle for Java is vulnerable to improper tag-length validation. The vulnerability is due to the failure to enforce the required authentication tag length during decryption, which allows an attacker to provide a malformed or truncated authentication tag and potentially bypass the intended...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

EUVD-2026-66248

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

SUSE CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098936)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098936 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098925)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098925 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accept...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104562)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104562 advisory. In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum...

SUSE CVE-2026-68451

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests ccaecc2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length excee...

SUSE CVE-2026-68452

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length The ieee80211mlecommonsize function uses the first octet of the common information length as the common information length for all known MLE types. However, the ieee80211mlesizeok...