EUVD-2026-74502

Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87604

CVE-2026-87604 is an out-of-bounds read in ANGLE , the graphics library used by Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to potentially execute arbitrary code outside the sandbox , escalating from ...

NewStart CGSL MAIN 7.02 : rsync Vulnerability (NS-SA-2026-0113)

The remote NewStart CGSL host, running version MAIN 7.02, has rsync packages installed that are affected by a vulnerability: - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious...

Oracle Linux 8 : ELSA-2026-63163-0: / container-tools:ol8 (ELSA-2026-631630)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631630 advisory. - rebuild with updated Go to fix CVE-2026-42499 - rebuild with updated Go to fix CVE-2026-42499 - rebuild with Go 1.25.11 to fix CVE-2026-33818,...

AZL-99644 CVE-2026-80827 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

AZL-99561 CVE-2026-80823 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATRREQ length against the received frame st21nfcatmrecvatrreq checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq-length is at least sizeofstruct...

AZL-99452 CVE-2026-80814 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

AZL-99657 CVE-2026-80799 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops: 1. 'offset' is declared u8 but tlvarraylen is u16. When TLV data...

AZL-99596 CVE-2026-80800 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

AZL-99507 CVE-2026-80796 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

AZL-99407 CVE-2026-80781 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80827

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80827 USB: serial: option: fix slab OOB read in interrupt URB callback

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80827

CVE-2026-80827 affects the Linux kernel's USB serial option driver (usb-serial-option). The interrupt URB buffer is allocated in setup_port_interrupt_in() using the endpoint's wMaxPacketSize via kmalloc(). When a USB device declares wMaxPacketSize = 8, the buffer is exactly 8 bytes. If the device...

EUVD-2026-71277

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80823

CVE-2026-80823 is a Linux kernel vulnerability in the nfc: st21nfca NFC driver. The function st21nfca_tm_recv_atr_req() validates that a received ATR_REQ frame meets a minimum size and that its self-declared length is at least the struct size, but never checks that the declared length does not ex...

CVE-2026-80823 nfc: st21nfca: validate ATR_REQ length against the received frame

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATRREQ length against the received frame st21nfcatmrecvatrreq checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq-length is at least sizeofstruct...

CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

CVE-2026-80814

A vulnerability in the Linux kernel 's rndis_host driver (a USB RNDIS host driver) was identified in the rndis_rx_fixup() function. The root cause is a missing overflow check: if data_offset + data_len + 8 wraps around, it enables an out-of-bounds (OOB) read of the USB data buffer. The fix, as de...

EUVD-2026-71249

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...