tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow

...

Google Chrome Out-of-Bounds Read Vulnerability (CNVD-2026-15401)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause out-of-bounds memory access to be performed via specially crafted HTML pages...

PT-2026-28386

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.6 Description Open WebUI is a self-hosted artificial intelligence platform designed for offline operation. A flaw exists where any authenticated user can access private memories and files belonging to other...

The vulnerability of the `register_synth_event()` function in the kernel/trace/trace_events_synth.c module, which supports Linux kernel tracing, allows a malicious actor to access protected information or cause system failures.

The vulnerability of the registersynthevent function in the kernel/trace/traceeventssynth.c module, which supports kernel tracing in Linux operating systems, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to access...

CVE-2026-23335

A flaw was found in the Linux kernel's RDMA/irdma component. This vulnerability, located in the irdmacreateuserah function, is caused by uninitialized reserved memory. An attacker could potentially exploit this to leak 4 bytes of sensitive stack memory, leading to information disclosure...

CVE-2025-64646

IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources...

UBUNTU-CVE-2026-33809

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error...

CVE-2026-23363

A flaw was found in the Linux kernel's mt76 wireless driver, specifically within the mt7925 component. This vulnerability arises from a failure to properly check the frame length before accessing management fields in the mt7925macwritetxwi80211 function. An attacker could potentially exploit this...

CVE-2026-23317

A flaw was found in the drm/vmwgfx component of the Linux kernel. Incorrect error handling in the vmwtranslateptr functions could cause them to return a success status even when an internal lookup operation failed. This could lead to the use of uninitialized pointers and out-of-bounds OOB memory...

SUSE CVE-2026-23335

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdmacreateuserah struct irdmacreateahresp // 8 bytes, no padding u32 ahid; // offset 0 - SET uresp.ahid = ah-scah.ahinfo.ahidx u8 rsvd4; // offset 4 - NEVER SET - LEAK ; rsvd4: 4 bytes of sta...

SUSE CVE-2026-23390

In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dmamapsg tracepoint arrays to prevent buffer overflow The dmamapsg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers,...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability...

CVE-2026-23346

A flaw was found in the Linux kernel, specifically within the arm64 architecture's I/O memory mapping ioremapprot functionality. On systems with Privileged Access Never PAN enabled, a local user could exploit this by triggering a scenario where the kernel attempts to access a user memory mapping...

CVE-2026-23384

A flaw was found in the Linux kernel, specifically within the RDMA/ionic component. This vulnerability is a kernel stack leak that occurs in the ioniccreatecq function. It could allow an attacker to gain unauthorized access to sensitive information by leaking up to 11 bytes of stack memory. This...

EUVD-2026-15391

In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dmamapsg tracepoint arrays to prevent buffer overflow The dmamapsg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers,...

EUVD-2026-15298

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdmacreateuserah struct irdmacreateahresp // 8 bytes, no padding u32 ahid; // offset 0 - SET uresp.ahid = ah-scah.ahinfo.ahidx u8 rsvd4; // offset 4 - NEVER SET - LEAK ; rsvd4: 4 bytes of sta...

SUSE CVE-2026-4674

Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

CVE-2026-23343

In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpfxdpfragsincreasetail, clearly...

UBUNTU-CVE-2026-23343

In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpfxdpfragsincreasetail, clearly...

UBUNTU-CVE-2026-23386

In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gvetxcleanpendingpackets for QPL In DQ-QPL mode, gvetxcleanpendingpackets incorrectly uses the RDA buffer cleanup path. It iterates numbufs times and attempts to unmap entries in the dma array...