Linux Distros Unpatched Vulnerability : CVE-2026-74488

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the...

Linux Distros Unpatched Vulnerability : CVE-2026-74556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: libiscsitcp: Bound SCSI Response data segment to the connection buffer iscsitcphdrdissect receives the data segment of several PDU types into the fixed-si...

Linux Distros Unpatched Vulnerability : CVE-2026-72066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states,...

Linux Distros Unpatched Vulnerability : CVE-2026-72106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0,...

Linux Distros Unpatched Vulnerability : CVE-2026-74391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed...

PT-2026-72288

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash offset twice hash offset is already incremented in the loop "for i = 0; i to copy; i++, ts--". Do not increment it again...

PT-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding frame count tbnet poll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

PT-2026-72736

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...

PT-2026-72835

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm xattrs read buffer evm read xattrs allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlentemp to simple read from buffer. When no configured xattrs are enable...

PT-2026-72777

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal buf without validating the response length. A response exceeding...

PT-2026-72303

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm rx setup for RTR replies bcm tx setup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TX SETUP, but bcm rx setup never did the same for the RTR-reply frame...

PT-2026-72786

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2 validate inode block already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...

PT-2026-72353

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand select target' 'cs' here must be in range 0:nanddev ntargets...

PT-2026-72219

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ata dev config cpr function within the libata-core module. The function retrieves the number of range descriptors from buf0 of the concurrent positioning ranges lo...

PT-2026-72183

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211 mle common size uses the first common-info octet as the common information length for all known MLE types. However, ieee80211 mle size ok only validates that octet for...

PT-2026-72186

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs mem mmap access spufs mem mmap access computes the local store offset as address - vma-vm start, but bounds-checks it against vma-vm end instead of the local store size. On 64-bit,...

PT-2026-72449

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd sof update control In snd sof update control, firmware-provided cdata-num elems is checked against local cdata-data-size but never against the actual allocation size. If local...

PT-2026-72388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The NTFS mapping-pairs parser accumulates relative Logical Cluster Number LCN deltas using a signed integer. A corrupted attribute can cause this addition to exceed the representable...

PT-2026-72884

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...