CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-18401

A flaw was found in jackson-core. The non-blocking asynchronous JSON parser does not properly enforce the maximum number length constraint. A remote attacker can exploit this by submitting a specially crafted JSON document containing an arbitrarily long number to an application using the...

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

EUVD-2026-55157

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-44630

The Apache IoTDB RPC service is vulnerable to a denial of service (DoS) due to improper validation of length fields. A remote unauthenticated attacker can send a crafted malformed Thrift frame , forcing the system to allocate excessive memory and crash with an OutOfMemoryError . This issue affect...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

CVE-2026-68373: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

CVE-2026-68088: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

PT-2026-69672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference exists in the amdgpu driver. An unprivileged process in the render group can trigger this by submitting an AMDGPU CHUNK ID CP GFX SHADOW chunk with the length ...

PT-2026-69773

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs during scanning when the device delivers a truncated beacon or probe response frame. The at76 guess freq function only verifies that the received frame is at...

PT-2026-69751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the carl9170 cmd callback function. When the firmware sends a command response with a length mismatch, the system logs the error and initiates a restart b...

Linux Distros Unpatched Vulnerability : CVE-2026-68373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before...

PT-2026-69802

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cfg80211 is element inherited function where the first data octet of a candidate element is read to check an extension non-inheritance list without verifying if th...

Linux Distros Unpatched Vulnerability : CVE-2026-68123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later...

PT-2026-69524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap write exists in the MCTP serial receive state machine. The issue occurs in the mctp serial push header function when a frame length byte of zero is processed. Becau...

PT-2026-69739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btusb recv event realtek function where the system reads the event code at data0 and the Realtek subevent code at data2 without first validating the event length...

CVE-2026-68145: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...