PT-2026-72540

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid bpf get data range check hid bpf get data returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocated size. The current check adds rdwr buf size and offset...

PT-2026-73028

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobj ext array from its own slab" avoided recursive allocation of obj exts from kmalloc caches of the same...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72786

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...

PT-2026-72388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The NTFS mapping-pairs parser accumulates relative Logical Cluster Number LCN deltas using a signed integer. A corrupted attribute can cause this addition to exceed the representable...

PT-2026-72884

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...

PT-2026-72303

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm rx setup for RTR replies bcm tx setup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TX SETUP, but bcm rx setup never did the same for the RTR-reply frame...

PT-2026-72777

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal buf without validating the response length. A response exceeding...

PT-2026-72835

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm xattrs read buffer evm read xattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simple read from buffer. When no configured xattrs are enable...

PT-2026-72736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...

PT-2026-72653

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out norqst exit in rpcrdma reply handler branches away before the credit clamp, so a reply that matches no pending request reaches out post carrying the raw credit value...

PT-2026-72587

In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp frame The size of xdp redirect arr array is ENETC MAX SKB FRAGS. However, the number of fragments contained in xdp frame may be greater than or equal to ENETC MAX SKB FRAGS, whic...

Linux Distros Unpatched Vulnerability : CVE-2026-74378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validate...

Linux Distros Unpatched Vulnerability : CVE-2026-74470

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds allocle...

Linux Distros Unpatched Vulnerability : CVE-2026-74458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A...

Linux Distros Unpatched Vulnerability : CVE-2026-74452

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the...

PT-2026-72353

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand select target' 'cs' here must be in range 0:nanddev ntargets...

PT-2026-72288

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash offset twice hash offset is already incremented in the loop "for i = 0; i to copy; i++, ts--". Do not increment it again...

PT-2026-72449

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd sof update control In snd sof update control, firmware-provided cdata-num elems is checked against local cdata-data-size but never against the actual allocation size. If local...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...