Moderate: Red Hat Security Advisory: tftp security update

An update for tftp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-90246

A flaw was found in AppArmor within the Linux kernel. An unprivileged user can exploit an integer overflow vulnerability in the verifytags function by crafting a malicious AppArmor policy. This flaw allows an attacker to trigger an out-of-bounds read during policy loading, which could lead to...

CVE-2026-90230

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics in-band authentication negotiation message with an invalid transfer length or identifier lengths, could trigger a heap out-of-bounds read in the nvmetauthnegotiate...

CVE-2026-90223

A flaw was found in the Near Field Communication NFC Logical Link Control Protocol LLCP in the Linux kernel. This vulnerability allows a nearby unauthenticated NFC device to trigger an out-of-bounds read during the parsing of Service Name List SNL Type-Length-Value TLV lists. This can occur due t...

CVE-2026-90285

A flaw was found in the Linux kernel's scsi: qla2xxx component. A redundant read of the Vital Product Data VPD flash in the qla2x00sysfsreadvpd function occurs without the necessary locking mechanism. This exposes flash access to concurrent operations, which can lead to unpredictable behavior or...

CVE-2026-90266

A flaw was found in the Linux kernel's btrfs zoned filesystem. When metadata over-commitment occurs during a reclaim operation, the btrfsdelayedrefsrsvrefill function may return a transient error -EAGAIN. This error can cause the current transaction to abort, leading to the filesystem being force...

CVE-2026-90314

A flaw was found in the Linux kernel's remoteproc component. This vulnerability allows a local attacker to trigger an out-of-bounds read by providing a specially crafted offset from firmware. The issue arises because a 32-bit unsigned integer offset is incorrectly handled as a signed integer,...

CVE-2026-90307

A flaw was found in the Linux kernel. A remote attacker could exploit a vulnerability in the SCSI Remote Protocol SRP implementation by sending a specially crafted, truncated credential request. This malformed request causes an out-of-bounds read, leading to a heap information leak of up to 8 byt...

CVE-2026-90263

A flaw was found in the Linux kernel's btrfs filesystem. A local user could bypass the intended read-only protection by setting a POSIX Access Control List ACL on a btrfs filesystem configured as read-only. This vulnerability occurs because the setacl code path fails to properly check the...

CVE-2021-43798

CVE-2021-43798 Directory Traversal and Arbitrary File Read on Grafana Authors: Wagner Alves - Red Team Analyst This exploit leverages Directory Traversal and Arbitrary File Read vulnerabilities in Grafana 8.0 - 8.3, allowing it to read files such as /etc/passwd, /etc/hosts, /home/user/.ssh/idrsa,...

CVE-2026-90177

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability arises because the atomic Read-Modify-Write RMW verification process does not consistently check pointer types across all execution paths. Specifically, it only records the instruction pointer type when...

CVE-2026-90174

A flaw was found in ksmbd in the Linux kernel. A remote attacker can send a specially crafted login response with an oversized hash size during the authentication process. This can lead to a slab-out-of-bounds read in the ksmbdallocuser function, potentially resulting in information disclosure or...

CVE-2026-90170

A flaw was found in ksmbd, a component of the Linux kernel. This vulnerability occurs because the ipcvalidatemsg function reads length fields from an Inter-Process Communication IPC response buffer before verifying if the buffer is large enough. A local attacker, by providing a specially crafted...

CVE-2026-90161

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to...

CVE-2026-90143

A flaw was found in the Linux kernel's KCM Kernel Connection Multiplexer component. The kcmparsefuncstrparser function, which runs a BPF Berkeley Packet Filter parser, does not properly hold an RCU Read-Copy-Update read lock. This oversight can lead to BPF map operations triggering a warning,...

CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An...

CVE-2026-65200

The openUBMC device-management process is vulnerable to an out-of-bounds heap read due to an integer underflow. Three response parsers within the shared transport libraries fail to perform a lower-bound check when subtracting a fixed header or reserved-field size from a device-supplied response l...

CVE-2026-74034

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

DEBIAN-CVE-2026-109950

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...

DEBIAN-CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...