EUVD-2026-103473

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

CVE-2026-112012 libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-112012

The libtta library (versions through 2.3 ) contains a stack out-of-bounds read and write vulnerability within the tta_decoder_process_stream() and tta_decoder_process_frame() functions. The root cause is that header checks fail to reject a zero channel count . An attacker can provide a specially ...

EUVD-2026-103465

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

PT-2026-116839

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: unregister net devices in case of probe failure If register netdev fails for one of the MTK MAX DEVS devices in mtk probe, the error path jumps to err deinit ppe, skipping mtk unreg dev. The previously...

PT-2026-117000

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtk drm bind When the device is not the mmsys master, mtk drm bind returns early after taking a reference on the disp-mutex device via of find device by node, without ever dropping it: mtk...

Linux Distros Unpatched Vulnerability : CVE-2026-98801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 net: add new socket option SORESERVEMEM and commit d00c8ee31729 net: fix possibl...

Linux Distros Unpatched Vulnerability : CVE-2026-98599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, thi...

AlmaLinux 10 : kernel (ALSA-2026:83207)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83207 advisory. kernel: netfilter: nfnetlinkqueue: do shared-unconfirmed check before segmentation CVE-2026-45859 kernel: net/sched: actct: Only release RCU read lock...

Linux Distros Unpatched Vulnerability : CVE-2026-98486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a...

Linux Distros Unpatched Vulnerability : CVE-2026-98831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full...

Linux Distros Unpatched Vulnerability : CVE-2026-98780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded...

Linux Distros Unpatched Vulnerability : CVE-2026-98502

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: alps: unregister DualPoint Stick input device on remove alpsinputconfigured allocates a second input device DualPoint Stick with inputallocatedevice and...

Linux Distros Unpatched Vulnerability : CVE-2026-98598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under...

CVE-2026-98581: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2024:1731430561)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2024:1731430561 advisory. - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way...

Linux Distros Unpatched Vulnerability : CVE-2026-98666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe...

Linux Distros Unpatched Vulnerability : CVE-2026-98811

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change ...

Linux Distros Unpatched Vulnerability : CVE-2026-98570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push...

Linux Distros Unpatched Vulnerability : CVE-2026-98443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after...