github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

CVE-2026-74641: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

PT-2026-79646

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA usx2y component where the snd us428ctls vm fault function converts a faulting page offset into a kernel address without performing any boundary checks. Becaus...

CVE-2026-74602: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...

Linux Distros Unpatched Vulnerability : CVE-2026-74641

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset =...

JLSEC-2026-1360 Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Impact Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging...

Security Bulletin: This Power System update is being released to address CVE-2026-16933

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hoste...

CVE-2026-45201 GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value. Such crafted log2 page size could lead to 4K pages being treated a...

SUSE CVE-2026-68230

In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if the zonesnum is bigger than zoneweight. This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:1...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102065)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102065 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in rangeisholeinparent Before accessing the diskbytenr fiel...

Improper Control of Dynamically-Managed Code Resources

Overview asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the Interpreter process when evaluating attacker-controlled expressions with numpy enabled. A...

CVE-2026-74322

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability allows an attacker to trigger an invalid memory access when processing specific Wi-Fi frames. This can lead to a system crash, resulting in a Denial of Service DoS for affected systems...

CVE-2026-74285

A flaw was found in the Linux kernel's network subsystem. An issue in the netifrxqcleanupunlease function, responsible for tearing down network queue memory providers, allows a device to perform Direct Memory Access DMA to an incorrect memory address. This occurs because the DMA mappings are...

kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset

A flaw was found in the Linux kernel's drm/i915/gem component. This vulnerability occurs because the sgpage function incorrectly scales pread/pwrite operations for physical Buffer Objects BO when a non-zero offset is used. This can lead to incorrect memory access, potentially allowing an attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-75145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long...

CVE-2026-16933

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 through OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker...

CVE-2026-16933

IBM Power Systems firmware (CWE-190 integer overflow) in the BMC/FSP-host interface allows an attacker with root or service-account access to read/write arbitrary host memory, achieving full control of the host and all partitions (CVSS 8.2 HIGH). Remediation requires upgrading to specific firmwar...

CVE-2026-16933 Power System Integer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 through OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker...

CVE-2026-16933 Power System Integer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 through OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker...

EUVD-2026-62582

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...