kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. The driver fails to validate the size of Video BIOS VBIOS tables, allowing the calculated entry count to exceed the bounds of an internal array. A local attacker or compromised firmware image could exploit this flaw to trigger an...

kernel: ALSA: hda/cs35l41: Fix firmware load work teardown

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

kernel: drm/amd/display: set new_stream to NULL after release

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dmupdatecrtcstate function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a...

kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

CLSA-2026-1792717203 ImageMagick: Fix of 22 CVEs

CVE-2026-109278: fix memory leak in the wavelet denoise path - CVE-2026-109282: do not return a stdio handle for compressed blobs in INFO/JSON - CVE-2026-109269: check JPEG component count before reading sampling factors - CVE-2026-109964: check PICT row offsets for overflow - CVE-2026-109266:...

CLSA-2026-1792716976 ImageMagick: Fix of 22 CVEs

CVE-2026-109278: fix memory leak in the wavelet denoise path - CVE-2026-109282: do not return a stdio handle for compressed blobs in INFO/JSON - CVE-2026-109269: check JPEG component count before reading sampling factors - CVE-2026-109964: check PICT row offsets for overflow - CVE-2026-109266:...

CVE-2026-115504

A flaw was found in cfitsio. An attacker could exploit this vulnerability by enticing a user or automated system to process a specially crafted Flexible Image Transport System FITS file. Due to improper bounds checking when handling variable-length string columns in the ffgcls2 function, an...

CVE-2026-98728

A flaw was found in the Linux kernel's Trusted Platform Module TPM driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to...

CVE-2026-115389

A flaw was found in Wasmtime. The runtime does not adequately account for host memory allocations when converting guest values through the dynamically-typed Val application programming interface API, bypassing configured resource consumption limits. A malicious WebAssembly guest can exploit this...

CVE-2026-115393

A flaw was found in Wasmtime. Several Store application programming interfaces APIs fail to verify that objects belong to the expected execution engine. If an embedding application mixes objects between different engines, this type confusion can lead to memory corruption, including out-of-bounds...

CLEANSTART-2026-WJ10248 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-CX91057 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-XN90031 native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, with...

Security vulnerability affects the sonarqube package. The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays withi...

CLEANSTART-2026-FX89587 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the argo-cd package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-TJ72620 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the argo-cd package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CLEANSTART-2026-QM07954 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Security vulnerability affects the argo-cd package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CLEANSTART-2026-NC34833 PHP has various global state that temporarily points into request memory

Security vulnerability affects the php package. PHP has various global state that temporarily points into request memory...