PT-2026-90249

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

PT-2026-90290

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array block check validates blocknr and csum and nothing else, while node check, next to it, has bounded the structural fields since both were written. dm array cursor next takes its...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-90178

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040 get vcell and max17040 get soc ignore errors returned by regmap read. When an I2C transfer fails, the uninitialized register value is converted and reported to...

PT-2026-90159

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst if get perf level mask and isst if get base freq mask use the user-provided level as an index into perf levels via read pp level info and read bf level info, but neither...

PT-2026-90144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...

Linux Distros Unpatched Vulnerability : CVE-2026-49836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path...

Linux Distros Unpatched Vulnerability : CVE-2026-88914

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an...

Linux Distros Unpatched Vulnerability : CVE-2026-89147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smuxaccept performs an unauthenticated blocking read without timeou...

PT-2026-90436

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs sb verify signature bounds the on-disk ubifs sig node-len field before handing the signature payload to verify pkcs7 signature, but the check has the wrong sign: if le...

PT-2026-89765

PCRE2 before 10.48 has a pcre2 match out-of-bounds read during the PCRE2 MATCH INVALID UTF matching of an invalid UTF subject...

PT-2026-90141

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hp init bios package attribute validates obj-package.count and then calls one of the five ...

AlmaLinux 9 : kernel (ALSA-2026:64808)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64808 advisory. kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership CVE-2026-52933...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : libEBML vulnerability (USN-8746-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8746-1 advisory. It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a...

Linux Distros Unpatched Vulnerability : CVE-2026-79514

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the gfdmdatareceived function downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTT...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90330

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcn empty bits per page is sized from vol-nr clusters at mount, but ntfs cluster alloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

PT-2026-90337

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221 raw event mcp2221 raw event never validates the size of incoming HID reports. In the MCP2221 I2C GET DATA path it trusts the device-supplied data3 as the copy length without checking...

PT-2026-90365

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-90063

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...