CLSA-2026-1789580327 rsync: Fix of CVE-2026-70456

CVE-2026-70456: reserve room for the trailing NULL before readargs stores it, so a post-dot daemon request that lands argc on maxargs cannot write one slot past the argv allocation...

CLSA-2026-1789579460 rsync: Fix of CVE-2026-70456

CVE-2026-70456: reserve room for the trailing NULL before readargs stores it, so a post-dot daemon request that lands argc on maxargs cannot write one slot past the argv allocation...

libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

CVE-2026-89869

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

CVE-2026-89869

The Linux kernel's qcom iris media driver has a race condition in the VPU power-off path. The function iris_vpu_power_off() used disable_irq_nosync(), which does not wait for an already-queued threaded IRQ handler to finish. As a result, a threaded IRQ handler could still execute after the VPU ha...

CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

CVE-2026-89783

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

DEBIAN-CVE-2026-89783

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89783

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89783 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

EUVD-2026-80304

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89783

CVE-2026-89783 is an out-of-bounds write in the Linux kernel's xfrm6_input_addr() function (net/ipv6/xfrm6_input.c). An off-by-one in the depth check (1 + sp->len == XFRM_MAX_DEPTH instead of >=) allows a write to index 6 of a 6-element xvec[] array when the security path is already at maxi...

PT-2026-93510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iris vpu power off function where the use of disable irq nosync fails to wait for queued threaded IRQ handlers to complete before returning. This can lead to a...

Linux Distros Unpatched Vulnerability : CVE-2026-90011

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds...

PT-2026-93389

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the xfrm6 input addr function. The issue occurs when the secpath is full, caused by an off-by-one error in the depth check. When the transport-mode recei...

CVE-2026-54251

netty-incubator-codec-ohttp is a Netty incubator library implementing Oblivious HTTP (OHTTP) gateway and client functionality. Prior to 0.0.23.Final , the OHTTP gateway decryption path allocates a pooled direct (native off-heap) ByteBuf for decrypted plaintext before the AEAD tag is verified. Whe...

EUVD-2026-78879

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251: Improper Control of a Resource Through its Lifetime

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...