CVE-2026-80722

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

CVE-2026-80717

CVE-2026-80717 is an information disclosure vulnerability in the Linux kernel SCTP subsystem. The root cause is that sctp_verify_param() accepts a header-only Adaptation Layer Indication parameter because the generic parameter walker only checks for header presence. sctp_process_param() then read...

CVE-2026-80717 sctp: validate Adaptation Indication parameter length

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...

CVE-2026-80717

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...

CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

EUVD-2026-67528

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652

CVE-2026-80652 affects the Linux kernel 's AMD SEV/CCP driver (drivers/crypto/ccp/sev-dev.c ). When handling a PDH export, a zero-length userspace cert chain buffer is not treated as a blob-length query, causing a BUG_ON() crash at arch/x86/mm/physaddr.c due to a physical-address lookup on ZERO_S...

EUVD-2026-67471

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-80595

CVE-2026-80595 affects the Linux kernel 's ims-pcu driver. The driver processes response data from device buffers without verifying that the device actually sent enough data , which can lead to out-of-bounds reads or processing stale data . The fix adds checks for the expected response length bef...

CVE-2026-80595 Input: ims-pcu - add response length checks

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-80595

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-82238: Time-of-check Time-of-use (TOCTOU) Race Condition

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

PT-2026-83090

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

PT-2026-83069

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

PT-2026-82895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ims-pcu driver processes response data from device buffers without verifying if the device sent sufficient data. This flaw can result in out-of-bounds reads, where the system accesse...

The vulnerability of the Rsync file transfer and synchronization utility, related to errors in processing parameter length settings, allows a hacker to trigger a service failure.

The vulnerability of the Rsync file transfer and synchronization utility is related to errors in processing parameter length settings. Exploiting this vulnerability can allow a remote attacker to cause service failures...