CVE-2026-19667 Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

DEBIAN-CVE-2026-89926

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89864

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

DEBIAN-CVE-2026-89864

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

AZL-101558 CVE-2026-89864 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

EUVD-2026-80625

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-89999

CVE-2026-89999 is an out-of-bounds read in the Linux kernel's HID wacom driver , specifically in wacom_intuos_pro2_bt_irq(). The function receives the wire report length but never validates it before parsing; sub-parsers dereference wacom->data at fixed offsets (up to byte 285 for INTUOSP2_BT/...

CVE-2026-89926

CVE-2026-89926 affects the Linux kernel KVM s390 subsystem in the __import_wp_info() function. The root cause is a type truncation : the user-space-controlled kvm_hw_breakpoint::len (a __u64) is assigned to wp_info->len (an int). The bounds check evaluates the truncated value, but the subseque...

CVE-2026-89926 KVM: s390: Fix length check __import_wp_info()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89926 KVM: s390: Fix length check __import_wp_info()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89864

CVE-2026-89864 is a buffer overflow in the Linux kernel 's scsi: qla2xxx driver. The struct qla_i2c_access carries a 16-bit length field paired with a fixed 64-byte buffer , but qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. Because the s...

EUVD-2026-80464

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

DEBIAN-CVE-2026-81634

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...

CVE-2026-81634 Possible heap buffer overflow during DNSSEC canonicalization

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...

Linux Distros Unpatched Vulnerability : CVE-2023-54397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content- Length headers accepting non-standard characters...

Linux Distros Unpatched Vulnerability : CVE-2026-89999

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing...

PT-2026-93736

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description A flaw in named occurs...