DEBIAN-CVE-2026-110604

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

CVE-2026-110604

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

DEBIAN-CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

UBUNTU-CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-110604

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

EUVD-2026-101232

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

EUVD-2026-101041

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-98392 Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-98392 Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-98392

The Linux kernel contains a bounds off-by-one vulnerability within the Bluetooth btintel_pcie driver. The issue exists in the btintel_pcie_msix_tx_handle() function, where the check for tfd_index incorrectly allows an out-of-range index. Specifically, because valid indices for txq->urbd0s/tfds...

CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-98392: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

PT-2026-114371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the Bluetooth component. In the btintel pcie msix tx handle function, the boundary check for indices into txq-urbd0s, txq-tfds, and txq-bufs is incorrect...

CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

CVE-2026-110604: Off-by-one Error

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

CVE-2026-90289

A flaw was found in the drm/amd/display component of the Linux kernel. An off-by-one error in the sizing of Multi-Stream Transport MST High-bandwidth Digital Content Protection HDCP per-connector arrays could lead to incorrect array handling. This issue stems from a discrepancy between the intend...

CVE-2026-90118

A flaw was found in the Linux kernel's NTFS filesystem driver. An off-by-one error in the ntfsdecompress function, when processing a specially crafted compressed data attribute, can lead to out-of-bounds writes. This could result in memory corruption, potentially allowing a local attacker to...

CVE-2026-90068

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Dynamic Audio Power Management DAPM component. An off-by-one error in the sndsocdapmputenumdouble function allows an out-of-bounds read when handling the second enum channel. This can lead to reading...

CVE-2026-104774

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...