CVE-2026-116544

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

EUVD-2026-109913

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parsemultipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116543

The Open5GS software (versions 1.3.0 through 2.8.0 ) is vulnerable to a heap out-of-bounds write in the parse_multipart() function. An unauthenticated attacker can cause memory corruption or a crash by sending a single crafted multipart/related request to the SBI interface of any network function...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544

Open5GS versions 2.6.1 through 2.8.0 are vulnerable to an out-of-bounds read in the parse_scheme_output() function located in lib/sbi/conv.c. The vulnerability is caused by incomplete length validation during SUCI de-concealment. Remote unauthenticated UEs or SBI peers can exploit this by submitt...

CVE-2026-80822

A flaw was found in the Linux kernel's mailbox: mchp-ipc-sbi component. This vulnerability arises from a missing null check for a memory allocation function. If the memory allocation fails, it can lead to an error condition, potentially causing a denial of service DoS where the system becomes...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.13 contains security vulnerabilities. These vulnerabilities stem from an error in the update order of NACL firewall entries. The Config field is written first, resulting in pending entries that are observed by the SBI implementation or the NACL hardware. This leads to...

CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI System Binary Interface return value, which dictates the number of bytes copied from shared memory into the RPMI RISC-V Platform Management Interface...

Ubuntu 22.04 LTS : OpenSBI vulnerability (USN-8853-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8853-1 advisory. It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial ...

USN-8853-1: OpenSBI vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

USN-8853-1 opensbi vulnerability

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

PT-2026-104819

It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service...

PT-2026-104951

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs gc kthread in f2fs sb info Instead of allocating f2fs gc kthread dynamically, embed it in f2fs sb info. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbi store -...

SUSE CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

Linux Distros Unpatched Vulnerability : CVE-2026-90191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notificatio...

DEBIAN-CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...