CVE-2026-51260

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51260

...

CVE-2026-51260

CVE-2026-51260 affects the schreibfaul1 ESP32-audioI2S component (version 3.4.5). The issue is an unsafe fixed-size memcpy in AudioBuffer::writeSpace(), where a full UINT16_MAX bytes are copied without validating available destination space, causing an out-of-bounds heap write. This is the concre...

PT-2026-65492

Unsafe fixed-size memcpy operation in AudioBuffer::writeSpace of schreibfaul1 ESP32-audioI2S 3.4.5 allows remote heap buffer overflow. The code copies a full UINT16 MAX bytes without validating destination available space, causing out-of-bounds memory write...

CVE-2026-51260

...

CVE-2026-51260

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Rocky Linux Security Update for glibc (RLSA-2026:2786) and kernel (RLSA-2026:2722)

Brocade SANnav OVA has provided security updates for Multiple vulnerabilities ias referenced in glibc RLSA-2026:2786, kernel RLSA-2026:2722 glibc RLSA-2026:2786 glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network...

AZL-94053 CVE-2026-64548 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

AZL-94061 CVE-2026-64539 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

CVE-2026-64548 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64548

The CVE-2026-64548 vulnerability affects the Linux kernel’s BPF/sockmap path. A truncation can occur in bpf_msg_push_data when the scatterlist ring is full or nearly full: len (from BPF ARG_ANYTHING) and copy size are both u32, and the code path uses copy + len to compute a page allocation. An at...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the thriftbufferedtransportreadslow and thriftframedtransportreadslow paths in the cglib transport bindings. An attacker can trigger the bug by sending a read request that spans both buffered data and new...

PT-2026-65223

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf, sockmap component where the bpf msg push data function fails to properly validate the sum of copy and len when the scatterlist ring is full or nearly full...

CVE-2026-64548: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

UBUNTU-CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64259

CVE-2026-64259 (Linux kernel, fuse-uring) : A race allowed a use-after-free in fuse-uring by letting a fuse_req on an SQE commit become findable after memcpy, if a malicious userspace sent commit SQEs before the request reached fuse-server. The fix reorders operations: moving fuse_uring_add_to_pq...

PT-2026-64480

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse-uring component. A malicious user could send commit SQEs Submission Queue Entries requests with unique commit-ids for requests that have not yet...