CVE-2026-90484

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

EUVD-2026-107230

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

CVE-2026-90484

A null pointer dereference exists in the Apache bRPC MySQL client response parser. When a server peer sends a zero-payload-length response packet , the brpc::policy::MysqlReply::ConsumePartialIOBuf function performs an unbounded 5-byte fetch that returns nullptr. The application subsequently atte...

CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

PT-2026-120570

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check is full package, after which the parser reads the response ty...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: prevented potential out-of-bounds reads in handleauthdone A explicit bounds check was performed on payloadlen to avoid possible out-of-bounds accesses during the callout. idryomov: changelog...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: csdsp: Validate the payload length before processing the block. The check for the payload length not exceeding the remaining bytes in the firmware file buffer should be performed before the block is processed. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: validate the length of the advertising payload sent via meshsend The meshsend function currently limits the MGMTOPMESHSEND operation based on the total command length. However, it does not verify whether the...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80801

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-72303

A flaw was found in the ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULENOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100169 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/setmasked payload length validateset accepted OVSKEYATTRMPLS as...

K000162482: Linux kernel vulnerability CVE-2026-22984

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handleauthdone Perform an explicit bounds check on payloadlen to avoid a possible out-of-bounds access in the callout. idryomov: changelog...

CVE-2026-64546

CVE-2026-64546 is a Linux kernel vulnerability in drm/edid that allows a heap out-of-bounds read in drm_parse_tiled_block() when parsing a crafted EDID tiled block. The root cause is casting a DisplayID block to a struct displayid_tiled_block and reading the fixed layout up to tile->topology_i...

CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

UBUNTU-CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

PT-2026-65221

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the drm parse tiled block function. The function casts a DisplayID block to a struct displayid tiled block and reads the layout up to tile-topology id...

SUSE CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...