SUSE CVE-2026-89879

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-90399: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

CVE-2026-90174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

PT-2026-94746

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stride mismatch exists in the ath11k wmi tlv mac phy caps parse function. The kcalloc function sizes the mac phy caps buffer using a clamped length, but the subsequent memcpy operation...

PT-2026-94986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cros typec register partner pdos function where partner Power Delivery Objects PDOs are copied from the EC TYPEC STATUS response into a fixed-size array caps...

CVE-2026-89879

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

AZL-101298 CVE-2026-89879 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

EUVD-2026-80479

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-89894: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

CVE-2026-89781: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89879: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

PT-2026-93487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the qla2x00 status entry function. The issue occurs when the FWI2 status path advances sense data and reduces par sense len by the value of rsp info len...

PT-2026-93520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s2255 fillbuff function where the memcpy operation uses the vc-jpg size variable to copy captured JPEG/MJPEG frames into the vb2 plane. The vc-jpg size value is...

PT-2026-93535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds write exists in the cx231xx driver. The functions vidioc s fmt vid cap and vidioc s std allow changes to device-wide geometry, specifically dev-width and dev-norm,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy In preparation for FORTIFYSOURCE, we are performing compile-time and run-time field bounds checking for memcpy, memmove, and memset. Avoid intentionally writing across neighboring fields...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: kheaders: Use an array declaration instead of a char. Under CONFIGFORTIFYSOURCE, memcpy will check the size of the destination and source buffers. Defining kernelheadersdata as “char” would trigger this check. Since these address...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: tools/nolibc/stdlib: fixed a memory error in realloc Pass userplen to memcpy, instead of heap-len, to prevent realloc from copying an extra sizeofheap bytes beyond the allocated region...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace the fake VLA at the end of vbvamousepointershape with a real VLA. Replace the fake VLA at the end of the vbvamousepointershape structure with a real VLA to fix a “memcpy: detected field-spanning write error...