10160 matches found
CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
CVE-2026-68458
CVE-2026-68458 concerns the Linux kernel Binder subsystem. A vulnerability arises in binder_transaction() where the end of the scatter-gather buffer area is computed using a value derived from lsmctx.len after security_release_secctx() zeroes that field. This causes sg_buf_end_offset to be inflat...
PT-2026-73009
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iscsi scsi cmd rsp function where sense data from a SCSI Response is copied from a target-supplied data segment. The segment includes a 2-byte sense length prefix...
CVE-2026-72241: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...
PT-2026-72278
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ivpu component where the fw log from bo function fails to verify that the log-size is at least as large as the log-header size. Consequently, the fw log prin...
PT-2026-72429
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overread can occur in the uleds component of the leds subsystem. This happens because the name string provided by userspace is not guaranteed to be null-terminated. When the...
PT-2026-72383
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the do action function within the UpdateResidentValue case of the ntfs3 file system. When the sum of lrh-attr off and lrh-redo len is less than attr-res.da...
SUSE CVE-2026-68366
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...
EUVD-2026-57922
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3571-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3571-1 advisory. This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer overread in BGR decoder due to...
The vulnerability of the phy/st/phy-stm32-usbphyc.c component in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the phy/st/phy-stm32-usbphyc.c component in the Linux operating system is related to reading data from beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE CVE-2026-68447
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...
CVE-2026-68447
A flaw was found in the Linux kernel's drm/amdkfd component. The Checkpoint/Restore in Userspace CRIU checkpoint process, which saves and restores the state of a running application, incorrectly copies the Memory Queue Descriptor MQD control stack. This occurs because the copy operation does not...
CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...
DEBIAN-CVE-2026-68431
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the...
SUSE SLED15: freerdp / freerdp-devel / freerdp-proxy / freerdp-proxy-plugins / etc (SUSE-SU-2026:3562-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3562-1 advisory. - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in StreamEnsureCapacity bsc1258939...
The vulnerability of the functions bitPutcs_aligned() and bitPutcs_unaligned() in the Linux kernel’s drivers/video/fbdev/core/bitblit.c file, which allows a hacker to cause a service failure.
The vulnerability of the functions bitPutcsaligned and bitPutcsunaligned in the Linux kernel’s drivers/video/fbdev/core/bitblit.c module lies in the fact that they allow data buffer sizes to exceed the allowed limits. Exploiting this vulnerability could enable an attacker to cause a service failu...
SUSE CVE-2026-68339
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...
