EUVD-2026-86814

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drainpebs reentry The PEBS buffer is shared by all events on a CPU, so drainpebs must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most...

CVE-2026-97960

The Linux kernel is vulnerable to a reentry issue in the perf/x86/intel component. The PEBS buffer is shared by all events on a CPU, meaning drain_pebs() must not be reentered; otherwise, an instance might observe a stale buffer state and potentially access out-of-bound memory . While most calls ...

CVE-2026-97540

The Linux kernel contains a vulnerability in the usb pegasus driver where the code incorrectly relies on id table pointer arithmetic when handling dynamic IDs. Because the usb_device_id parameter resides on the heap in these cases, the pointer arithmetic results in an out-of-bounds index . The is...

EUVD-2026-86847

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

Linux Distros Unpatched Vulnerability : CVE-2026-75895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34unpack function via attacker controlled SMPP PDUs, leading to memory...

CVE-2021-4034

CVE-2021-4034 本仓库包含用于 cve-2021-4034 的单文件漏洞利用程序，该漏洞是 Polkit 本地权限提升漏洞。请谨慎使用！ 漏洞描述 CVE-2021-4034，通常被称为 Pwnkit ，是 Polkit 中 pkexec 组件的一个内存损坏漏洞。Polkit 是用于在类 Unix 系统中定义和处理授权的工具包。该漏洞源于对环境变量的不当处理，允许本地用户以 root 用户身份执行任意代码。 核心问题在于 pkexec 在解析环境变量之前未能正确地对其进行清理。这导致在某些情况下出现越界 写入条件，最终允许本地权限提升。该漏洞自 2009 年 pkexec...

UBUNTU-CVE-2026-75895

In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34unpack function via attacker controlled SMPP PDUs, leading to memory corruption...

AZL-102114 CVE-2026-93046 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-93046 software node: Fix software_node_get_reference_args() with index -1

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-25282

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contains a “Out of Bound Read” issue in the xrdpmmtransprocessdrdynvcchannelclose function. There are no known solutions to this problem. Users are advis...

Oracle Linux 8 : ELSA-2026-64809-0: / expat (ELSA-2026-648090)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648090 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219 Tenable has extracted the preceding description block...

Oracle Linux 9 : ELSA-2026-64812-0: / expat (ELSA-2026-648120)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648120 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219 Tenable has extracted the preceding description block...

expat security update

2.5.0-2.2 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221012 2.5.0-2.1 - Fix CVE-2026-50219 - Resolves: RHEL-220979...

Oracle Linux 10 : ELSA-2026-64810-0: / expat (ELSA-2026-648100)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648100 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers - expat:...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053429)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053429 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays The frequency table arrays are...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053219)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053219 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table arrays are...

CVE-2026-74737

A flaw was found in the Linux kernel's am65-cpsw-nuss Ethernet driver. When processing incoming network packets, the driver incorrectly extracts the MAC Port ID from the Source Tag, using 16 bits instead of the intended lower 8 bits. This error can lead to the driver accessing out-of-bound memory...