CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-53794

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-53794: Improper Validation of Specified Quantity in Input

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

PT-2026-71632

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A logic error exists in the handling of the --max-alloc configuration. When a sender or configuration sets --max-alloc=0, allocation sanity checks are entirely disabled instead of enforcing a zero-byte...

CVE-2026-68365

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68291

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-68092

In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksour...

CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68400

CVE-2026-68400 concerns the Linux kernel firmware/arm_ffa component. The issue arises from an incorrect calculation of the Endpoint Memory Access Descriptor offset, where the code defaulted to the size of the ffa_mem_region instead of using the descriptor’s ep_mem_offset. The patch relocates ffa_...

CVE-2026-68291

CVE-2026-68291 covers a Linux kernel fix for the idpf driver: max_vports is now set only after successful allocation of vports, netdevs, and vport_config buffers, preventing crashes on reset or rmmod after a failed init. The description documents a kernel NULL pointer dereference in idpf_remove d...

EUVD-2026-55392

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

CVE-2026-68254

The Linux kernel component drm/i915/vrr was updated to enforce that EDID-provided min_vfreq and max_vfreq are valid for VRR. The root cause was inadequate validation of VRR frequencies, with a potential division-by-zero in intel_vrr_compute_vmax if min_vfreq was zero. The fix explicitly validates...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-18401

A flaw was found in jackson-core. The non-blocking asynchronous JSON parser does not properly enforce the maximum number length constraint. A remote attacker can exploit this by submitting a specially crafted JSON document containing an arbitrarily long number to an application using the...

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Summary RedisArrayAggregator clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header...

CVE-2026-56818

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...