CVE-2026-72163

A flaw was found in the Linux kernel's OCFS2 component. A local user with write access to an OCFS2 filesystem could trigger a kernel panic by performing a direct write over unwritten extents. This occurs when the journal aborts during Direct I/O DIO completion, leading to a NULL pointer dereferen...

CVE-2026-72018

A flaw was found in the Linux kernel's dibs: loopback functionality. A missing bounds check in the movedata function allows an attacker to provide an out-of-bounds offset or an oversized write. This can lead to an out-of-bounds write past an allocated kernel buffer, potentially causing memory...

CVE-2026-72015

A flaw was found in the Linux kernel's fs/resctrl component. A double-free vulnerability occurs when a pseudo-locked group's Resource Monitoring ID RMID is freed upon creation and then again during unmount operations by the rmdirallsub function. This double-free can lead to memory corruption,...

CVE-2026-72013

A flaw was found in the Linux kernel. Specifically, within the riscv architecture's machinekexecprepare function, a NULL pointer dereference can occur. This vulnerability arises when a NULL buffer is copied without proper validation during the kexec preparation process. An attacker could...

CVE-2026-45699

A flaw was found in Netatalk. An integer underflow vulnerability exists in the copydir function of the afpd daemon. This flaw occurs when a file operation crosses a device boundary within an Apple Filing Protocol AFP shared volume. Incorrect calculation of buffer size can lead to a stack-based...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-68475

A flaw was found in the Linux kernel. In the sunxiresetinit function, a memory region obtained during initialization is not properly released if the ioremap operation fails. This oversight can lead to a resource leak within the system...

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

Security Bulletin: Improper input validation, integer overflow, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to improper input validation, integer overflow, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message pars...

kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages

A flaw was found in the Linux kernel, specifically within the drm/amdgpu component. This vulnerability arises from incorrect handling of a notifier sequence in the amdgpuhmmrangegetpages function, where the sequence can be read more than once. This can lead to the system processing invalid memory...

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...

kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err()

A flaw was found in the Linux kernel’s SLUB memory allocator mm/slub. The function objecterr — used for debugging object metadata freelist pointer, redzone, etc. — can access invalid pointers when reporting corruption, leading to a crash. In some cases, due to freelist corruption e.g., detected b...

kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve()

A flaw was found in the Linux kernel's drm/amd/display component. The dalvectorreserve function calculates memory allocation size using 32-bit arithmetic, which can lead to an integer overflow. This overflow causes a smaller memory buffer to be allocated than intended, resulting in a heap overflo...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

CVE-2026-74442

A flaw was found in the Linux kernel's drm/vmwgfx driver. This vulnerability occurs when the vmwvkmsinit function fails to initialize a workqueue, leaving a pointer as NULL. During module unload, the vmwvkmscleanup function attempts to destroy this NULL workqueue, leading to a kernel panic. A loc...

CVE-2026-68474

A flaw was found in the Linux kernel, specifically within the powerpc/spufs component responsible for managing memory access. This vulnerability allows for an out-of-bounds memory access due to incorrect boundary checks in the spufsmemmmapaccess function. An attacker could exploit this to corrupt...

CVE-2026-68473

A flaw was found in the Linux kernel's powerpc/uaccess component. The maskuseraddress function incorrectly checks for CONFIGE500 instead of CONFIGPPCE500. This error prevents the maskuseraddressisel function from being used on PowerPC E500 hardware, which could lead to improper handling of user...