CVE-2026-80791

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

EUVD-2026-71434

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

CVE-2026-80791

CVE-2026-80791 affects the Linux kernel's NVM Express Target (nvmet) authentication module. In nvmet_execute_auth_receive(), the DH-HMAC-CHAP response buffer is allocated with kmalloc() sized by a host-supplied allocation length , but the DH-HMAC-CHAP builders write only a fixed-size message into...

CVE-2026-80791 nvmet-auth: zero the AUTH_RECEIVE response buffer

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80788

CVE-2026-80788 affects the Linux kernel NVMe-over-TCP target subsystem (nvmet-tcp ). A remote NVMe initiator can send a command with an oversized SGL (Scatter Gather List) field, causing nvmet_tcp_map_data() to allocate over one million scatterlist/iovec entries. This exceeds MAX_PAGE_ORDER , tri...

EUVD-2026-71431

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

EUVD-2026-71423

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80780 HID: pidff: fix OOB write when hid->inputs is empty

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80780

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

CVE-2026-80780

CVE-2026-80780 is an out-of-bounds write in the Linux kernel's HID: pidff driver, specifically in hid_pidff_init_with_quirks(). The function calls list_entry() on hid->inputs without verifying the list is non-empty. When hid->inputs is empty—possible with a USB device whose report descripto...

CVE-2026-80780 HID: pidff: fix OOB write when hid->inputs is empty

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid-inputs is empty hidpidffinitwithquirks derives its inputdev from listentryhid-inputs.next, struct hidinput, list without first checking that hid-inputs is non-empty. The list member of struct...

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the...

CVE-2026-85698

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader . The root cause is an attacker-controlled cell-count field that is read without bounds validation. A crafted malicious database file with a modified cell count value can trigger an index-out-of-b...

CVE-2026-85698 Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic...

CVE-2026-85698 Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic...

EUVD-2026-71147

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic...

CVE-2026-85698 Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic...