Linux Distros Unpatched Vulnerability : CVE-2026-74460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in t...

Linux Distros Unpatched Vulnerability : CVE-2026-72066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states,...

Linux Distros Unpatched Vulnerability : CVE-2026-72369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are...

Linux Distros Unpatched Vulnerability : CVE-2026-72106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0,...

Linux Distros Unpatched Vulnerability : CVE-2026-74391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed...

Linux Distros Unpatched Vulnerability : CVE-2026-74556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-si...

PT-2026-72846

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtw pci rx napi, new len is computed as the sum of pkt len 14-bit descriptor field, max 16383 and pkt offset drv info sz + shift, both...

PT-2026-72450

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes ext put/get The ipc control data buffer is allocated as kzallocmax size, where max size covers the entire struct sof ipc ctrl data including its flexible array payload. However,...

PT-2026-72490

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control update size calc In sof ipc3 control update, the expected size calculation uses firmware-provided cdata-num elems in arithmetic that could overflow on 32-bit platforms,...

PT-2026-73021

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: widen NAT rewrite delta to s32 in sip help tcp sip help tcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more...

PT-2026-73008

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi tcp: Bound SCSI Response data segment to the connection buffer iscsi tcp hdr dissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSI DEF MAX RECV SE...

PT-2026-72203

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv dless read receives a P DATA REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data size,...

PT-2026-72949

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd usb handle sync urb scales received sync packet sizes by the sender's stride and stores the result directly in out packet-packet sizei. If a connected USB device sen...

PT-2026-72557

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minix check superblock uses minix blocks needed to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

PT-2026-72387

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where resident $INDEX ROOT values are not fully validated during lookup. The index header fields, which are consumed by callers after lookup, lacked...

PT-2026-72845

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...

Linux Distros Unpatched Vulnerability : CVE-2026-72470

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE:...

PT-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding frame count tbnet poll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

PT-2026-73028

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobj ext array from its own slab" avoided recursive allocation of obj exts from kmalloc caches of the same...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...