CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80931

CVE-2026-80931 is an out-of-bounds read in the Linux kernel's DS28E17 1-Wire to I2C bridge driver (w1: ds28e17). During an I2C_M_RECV_LEN read, the device-controlled length byte (buf[0]) is not validated against the caller buffer size (34 bytes), allowing a read up to ~222 bytes out of bounds . P...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

UBUNTU-CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

cups: OpenPrinting CUPS: Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content...

CVE-2026-89045

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

PT-2026-96421

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: fix hardware header length for NBMA tunnels ip6gre tnl link config route accumulates the lower device's hardware header length into dev-hard header len whenever header ops is set. This is incorrect for both users of head...

PT-2026-96336

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs sb verify signature bounds the on-disk ubifs sig node-len field before handing the signature payload to verify pkcs7 signature, but the check has the wrong sign: if le...

PT-2026-90304

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPI APEI GHES component where the ghes handle arm hw error function incorrectly calculates the remaining length of a section after skipping the cper sec proc arm...

PT-2026-90278

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ip6 gre module where the ip6gre tnl link config route function incorrectly accumulates the lower device's hardware header length into the dev-hard header len...

PT-2026-90061

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the DS28E17 1-Wire to I2C bridge where the w1 f19 i2c master transfer function fails to properly validate the length of data received during an I2C M RECV LEN read...

PT-2026-90063

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the mt7996 driver where the default EEPROM firmware is parsed and copied without verifying its length. If a truncated file is used, the driver may read beyond the firmware...

PT-2026-90436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the UBIFS filesystem due to an incorrect sign in the signature length check within the ubifs sb verify signature function. The function incorrectly adds t...

PT-2026-90137

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the IPMB Intelligent Platform Management Bus component where the ipmb write function reads message fields before validating the length byte. This can lead to the reading o...

CVE-2026-54135: Uncontrolled Resource Consumption

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

PT-2026-90103

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the ALSA 6fire driver where the usb6fire comm receiver handler function forwards MIDI events using a length byte provided by the device without proper bounds checking. The...

PT-2026-96367

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata scsi write same xlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is buil...