CVE-2026-89495 ocfs2: bound namelen in dlm_migrate_request_handler

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

CVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

CVE-2026-81014

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

CVE-2026-81007 ipmi: ipmb: validate write message length

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

EUVD-2026-76330

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-81007

CVE-2026-81007 affects the Linux kernel 's ipmi/ipmb subsystem. The function ipmb_write() read message fields before validating the length byte, allowing a zero or short write to read uninitialized stack bytes and causing an integer underflow in the block write length when the length is smaller t...

CVE-2026-81007

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-81007 ipmi: ipmb: validate write message length

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80931

CVE-2026-80931 is an out-of-bounds read in the Linux kernel's DS28E17 1-Wire to I2C bridge driver (w1: ds28e17). During an I2C_M_RECV_LEN read, the device-controlled length byte (buf[0]) is not validated against the caller buffer size (34 bytes), allowing a read up to ~222 bytes out of bounds . P...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

UBUNTU-CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

cups: OpenPrinting CUPS: Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content...

CVE-2026-89045

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

PT-2026-90053

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...