PT-2026-106570

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 XFRM implementation where the functions xfrm6 local rxpmtu and xfrm6 local error dereference skb-sk assuming it always points to a full IPv6 socket. In certai...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

PT-2026-106522

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw michael mic verify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael mic to read past the...

PT-2026-106723

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT ConvertTrack to read pas...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

PT-2026-106701

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs skb reset frag walk iptfs skb reset frag walk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

PT-2026-106678

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw process probe response and the libipw network init call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and...

PT-2026-106515

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex search oui in ie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs,...

PT-2026-106499

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move smb2 ea to cifs In move smb2 ea to cifs, the while src size 0 loop condition is insufficient. It allows iteration to continue even if the remaining src size is too small to contain ...

PT-2026-106498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the smb3 enum snapshots function. When snapshot array size is smaller than GMT TOKEN SIZE, the function sets ret data len to the size of struct smb snapsh...

PT-2026-106517

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54 convert rev0 and p54 convert rev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

PT-2026-106494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only...

PT-2026-106297

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

PT-2026-106496

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-total read for compound encrypted PDUs In receive encrypted standard, server-total read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs handl...

PT-2026-107304

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissio...

PT-2026-106729

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite string in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request...

PT-2026-106512

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211 mesh preq size ok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211 mesh hwmp...

PT-2026-106627

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp pdma: fix wrong sg length in mmp pdma prep slave sg In mmp pdma prep slave sg, for each sg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg...

ROS-20261006-73-0315

The vulnerability in the drivers/pmdomain/imx/imx8m-blk-ctrl.c component of the Linux operating system is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...