401642 matches found
PT-2026-72874
In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng alg Remove sun4i ss rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i ss prng seed is missing locking and has a buffer overflow. sun4i ss prng generate...
PT-2026-72255
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states show adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGE SIZE buffer. Use sysfs emit...
PT-2026-72174
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...
PT-2026-72498
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2 ioctl query info validates the PASSTHRU FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bound...
PT-2026-72845
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...
PT-2026-72814
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get srq wqe get srq wqe reads wqe-dma.num sge from the shared receive queue buffer, which is mapped into userspace. It validates num sge against max sge, but then re-reads the same field to...
PT-2026-72405
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr buf to bvec stores before writing xdr buf to bvec writes a bio vec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When th...
Linux Distros Unpatched Vulnerability : CVE-2026-74460
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in t...
Linux Distros Unpatched Vulnerability : CVE-2026-72066
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states,...
Linux Distros Unpatched Vulnerability : CVE-2026-74438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is...
Linux Distros Unpatched Vulnerability : CVE-2026-74556
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-si...
PT-2026-72288
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash offset twice hash offset is already incremented in the loop "for i = 0; i to copy; i++, ts--". Do not increment it again...
PT-2026-72345
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding frame count tbnet poll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...
PT-2026-72736
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...
PT-2026-72835
In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm xattrs read buffer evm read xattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simple read from buffer. When no configured xattrs are enable...
PT-2026-72777
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal buf without validating the response length. A response exceeding...
PT-2026-72303
In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm rx setup for RTR replies bcm tx setup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TX SETUP, but bcm rx setup never did the same for the RTR-reply frame...
PT-2026-72786
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...
PT-2026-72816
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...