Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ctnetlink: Use netlink policy range checks. Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths. This ensures that netlink core rejects invalid values early and can...

kernel: wifi: cfg80211: validate PMSR FTM preamble range

A flaw was found in the cfg80211 component of the Linux kernel's Wi-Fi subsystem. This vulnerability allows the PMSR FTM request parser to accept preamble values outside the defined nl80211 range. An attacker could exploit this by providing malformed input, potentially leading to unexpected syste...

CVE-2026-86255

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

OESA-2026-3539 perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian...

AZL-97709 CVE-2026-80566 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: hynitroncstxxx - validate touch count and finger IDs The driver allocates maxtouchnum input slots, which are indexed from zero through maxtouchnum - 1. The current check allows a finger ID equal to maxtouchnum to reach...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: The block range must be validated before being used in ext4mbclearbb. The block range to be freed is validated in ext4freeblocks, using ext4 inodeblockvalid, and then it is passed to ext4mbclearbb. However, in some cases on...

CVE-2026-74349

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

CVE-2026-74349

The CVE-2026-74349 issue affects the Linux kernel’s OCFS2 filesystem, where FITRIM range handling incorrectly validated ranges that cross cluster boundaries. Specifically, ocfs2_trim_mainbm() trims the global bitmap in cluster units but only validates ranges against sb->s_blocksize; on filesys...

CVE-2026-74349 ocfs2: reject FITRIM ranges shorter than a cluster

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...

mm/damon/core: validate ranges in damon_set_regions()

...

DEBIAN-CVE-2026-68165

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...

OPENSUSE-SU-2026:21486-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

CVE-2026-35590

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

Linux Distros Unpatched Vulnerability : CVE-2026-35590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the ran...

PT-2026-52943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A soft lockup occurs when opening /dev/sgX due to improper validation of the def reserved size module parameter. While the sg proc write dressz function enforces a size limit between 0 a...

RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`

Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of Mmap::uncheckedadviserange, MmapMut::uncheckedadviseranage and MmapMut::flushasyncrange. This can cause undefined behavior due to invalid values being passed to pointer::offset and pointer::add when...

GHSA-V25J-WQCW-FVHJ wger has an Uncontrolled Resource Consumption issue

Summary Any authenticated user can create a routine spanning an arbitrarily long date range e.g. 100 years and then trigger the datesequence computation via any of the routine detail endpoints. The server iterates once per day in an unbounded while loop with no maximum duration validation, causin...

PT-2026-37469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the Integrity Measurement Architecture IMA measurement buffer passed from a previous kernel may fall outside the addressable RAM of a new kernel when the second-sta...