PT-2026-61405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the tt buff len field in batadv orig node is declared as a signed 16-bit integer s16. Because this field should not hold negative values,...

PT-2026-61256

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

PT-2026-61205

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit handle text cmd Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c "iscsi-target: Add iSCSI fabric...

PT-2026-61220

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

PT-2026-61257

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

PT-2026-61229

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp output head before esp output tail allocates the destination page frag. The head-side gate currently checks skb-data le...

PT-2026-61266

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message store linedisp display unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

PT-2026-61260

In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone process packet receives len directly from urb-actual length and uses it to index the share-button byte at datalen - 18 or datalen - 26. Since both len and data0 are...

PT-2026-61301

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6 rpl srh decompress ipv6 rpl srh decompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6 addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127...

PT-2026-61398

In the Linux kernel, the following vulnerability has been resolved: firmware: arm ffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, an...

PT-2026-61431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv4 raw socket implementation where the raw send hdrinc function fails to reject packets with an Internet Header Length ihl value of less than 5. According to RFC...

PT-2026-61419

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA Soft-iWARP siw component where the system fails to validate the MPA length field c hdr-mpa len of an incoming iWARP FPDU against the required header length fo...

PT-2026-61443

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT OP ADD EXT ADV DATA is registered as a variable-length command, with MGMT ADD EXT ADV DATA SIZE as the fixed header size. The handler then uses cp-adv data len a...

PT-2026-61426

In the Linux kernel, the following vulnerability has been resolved: af unix: Fix UAF read of tail-len in unix stream data wait unix stream data wait does skb peek tail&sk-sk receive queue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the ca...

PT-2026-61402

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hwmon subsystem where the adm1266 pmbus block xfer function copies a device-supplied block payload into a caller-provided buffer using a length specified by the...

PT-2026-61331

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data len/x len to URB buffer size nexio read data pulls data len and x len from a packed be16 header in the device's interrupt packet and then walks packet-data0..x len and packet-datax len..da...

PT-2026-61140

In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl pkey params get 2 The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating internal output with the...

CVE-2026-53994

ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...

EUVD-2026-45396

ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...

CVE-2026-53994

ProFTPD mod_sftp has a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts an attacker-controlled 32-bit big-endian SFTP packet length without minimum sanity checks. A value of 0 underflows in the read path, yielding an oversized request (~4 ...