CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

EUVD-2026-64585

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648

CVE-2026-74648 affects the rtl8723bs staging driver in the Linux kernel. The function rtw_cfg80211_monitor_if_xmit_entry() removes a radiotap header and then reads the 802.11 frame control field without verifying that a base 802.11 header remains. Additionally, the data path pulls the calculated ...

CVE-2026-74598

CVE-2026-74598 is an out-of-bounds read in the Linux kernel's IPv6 stack, specifically in rt6_route_rcv() handling of the Route Information option (RFC 4191). Both length checks are off by one: the code accepts length >= 2 and length >= 1 where RFC 4191 requires stricter bounds. A remote at...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

EUVD-2026-64535

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

PT-2026-79603

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6 route rcv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of...

PT-2026-79653

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw cfg80211 monitor if xmit entry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data...

Linux Distros Unpatched Vulnerability : CVE-2026-74598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both chec...

Linux Distros Unpatched Vulnerability : CVE-2026-74648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-74460

A flaw was found in the Linux kernel's emsusb module. This vulnerability occurs because the emsusbreadbulkcallback function, which processes Controller Area Network CAN Protocol Converter CPC messages from a USB receive buffer, does not properly validate the lengths of these messages. An attacker...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

CVE-2026-72065

A flaw was found in the Linux kernel's mana network driver. This vulnerability arises from the driver's failure to validate the packet length reported by the Network Interface Card NIC within the Receive Completion Queue Entry RX CQE before further processing. A malicious NIC, or an attacker...

UBUNTU-CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...