476 matches found
PT-2026-123384
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee dyn shm alloc helper tee dyn shm alloc helper derives nr pages from a caller-supplied size and passes it to alloc pages exact without checking it. For size == 0 nr pages is 0, and...
CVE-2026-89312
AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine...
CVE-2026-89312
"AesGcmCryptor.Open" passed a caller-supplied nonce straight to "cipher.AEAD.Open" without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly "NonceSize" bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine...
EUVD-2026-108632
AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine...
CVE-2026-89312
The AesGcmCryptor.Open function is vulnerable to a denial-of-service condition because it passes a caller-supplied nonce to cipher.AEAD.Open without performing a length check. Because the Go standard library panics instead of returning an error when a GCM nonce does not match the expected NonceSi...
PT-2026-121810
AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine...
Differently Sized Kittens’ configobj resource management error vulnerability
In versions of Differently Sized Kittens 5.0.9 and earlier, there is a resource management vulnerability. This vulnerability stems from an inefficient regular expression complexity issue in the sectionmarker function located in the configobj/init.py file. A remote attacker could exploit this...
Astra Linux – vulnerability in linux-5.10
In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: do not warn about zero-sized rawsendmsg syzbot triggers a warning at skbassertlen within devqueuexmit 1. For PFIEEE802154 sockets, a zero-sized rawsendmsg request results in devqueuexmit being called when skb-len ...
EUVD-2026-92981
Transient DOS when processing a continuous receive command with a zero-sized global configuration override...
PT-2026-106355
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DOS occurs when processing a continuous receive command that includes a zero-sized global configuration override. Recommendations A...
cow_vec (>=2.0.0, <=2.1.0), dropping-thread-local (>=0.1.0-alpha.0, <=0.1.5) +24 more potentially affected by unknown CVE via imbl-sized-chunks (0.1.3)
imbl-sized-chunks CARGO version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on imbl-sized-chunks and may be impacted: - cowvec =2.0.0, =0.1.0-alpha.0, =0.4.0, =0.2.0, =0.5.1, =0.6.0, =2.0.0, =0.1.0, =0.2.0, =1.0.0, =1.0.0, =0.16.2, =0.16.2,...
RUSTSEC-2026-0292 Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
Chunk::clear, dropleft, dropright and InlineArray::clear, truncate drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is...
Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
Chunk::clear, dropleft, dropright and InlineArray::clear, truncate drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is...
PT-2026-96196
Chunk::clear, drop left, drop right and InlineArray::clear, truncate drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update i...
SUSE CVE-2026-72343
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, before mlx5eopen. At that point priv-statsnch is still zero, because it is only ever incremented in...
SUSE CVE-2026-80577
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...
UBUNTU-CVE-2026-80577
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...
CVE-2026-80577 drm/panthor: skip zero-sized firmware sections
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...
EUVD-2026-66492
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...
SUSE CVE-2026-74417
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned cpp' calculation can overflow signed int. ...