CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

CVE-2026-90011 scsi: target: iscsi: Reserve a terminator byte for the login payload

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

CVE-2026-90011 scsi: target: iscsi: Reserve a terminator byte for the login payload

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

CVE-2026-89882 media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...

EUVD-2026-80480

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...

CVE-2026-89880 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...

CVE-2026-89880 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...

CVE-2026-89880

CVE-2026-89880 affects the Linux kernel rtl2832_sdr media driver (Realtek RTL2832 USB SDR radio). The root cause is a missing teardown on the error path of rtl2832_sdr_start_streaming(): when URB submission or allocation fails after stream buffers are allocated, the URBs and coherent DMA buffers ...

CVE-2026-89846 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-89846

CVE-2026-89846 is a critical out-of-bounds read in the Linux kernel's qla2xxx SCSI driver. In qla2x00_status_entry(), the FWI2 status path subtracts rsp_info_len (a 32-bit value from the target's FCP response) from par_sense_len (the IOCB data area size: 28 bytes for 24xx, 60 bytes for 29xx) with...

EUVD-2026-80446

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-89846 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-89818

CVE-2026-89818 is an integer overflow in the Linux kernel's drm/amdgpu/vcn driver, specifically in the dec_msg buffer count check. If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2, causing the bounds check to pass and allowing the parser loop to re...

CVE-2017-13672

CVE-2017-13672 PoCs para CVE-2017-13672 lectura fuera de límites en el controlador VGA Cirrus de QEMU, causando denegación de servicio...

AZL-101652 CVE-2026-89778 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

CVE-2026-65343-e7eb2ed

CVE-2026-65343 — Lectura OOB en AppleKeyStore Derrota de KASLR Componente: Extensión del kernel AppleKeyStore — LibSerSEPControlDeserialize Afecta a: iOS / iPadOS 26.6 23G71 y anteriores Corregido en: iOS / iPadOS 26.6.1 23G83 Tipo: Lectura fuera de límites en la deserialización de mensajes de...

CVE-2026-32945

CVE-2026-32945 Lectura fuera de límites del puntero de compresión DNS en el heap de PJSIP DoS remoto Descripción getnamelen y getname en pjlib-util/src/pjlib-util/dns.c leen un puntero de compresión DNS de 2 bytes mediante pjmemcpy&offset, p, 2 sin comprobar que ambos bytes se encuentren dentro d...

CVE-2026-84118-who-labeled-the-crit-as-a-high

CVE-2026-84118 — Use-after-free en el GC de SpiderMonkey Bug 2057457 Este es uno de esos casos en los que Mozilla etiquetó una Critical como High. Así que alguien podría querer que Firefox actualice el pago a los cazadores de bugs originales si ese es el caso. EL TLDR: Puedes hacer una primitiva ...