CVE-2026-89731

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxlrchgetaerinfo out-of-bounds AER register read cxlrchgetaerinfo copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aercapabilityregs. This struct is a...

TencentOS Server 4: swtpm (TSSA-2026:0967)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0967 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

SUSE CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

EUVD-2026-55587

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-52761: Use of sizeof() on a Pointer Type

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8tounicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a...

AZL-88863 CVE-2026-46190 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: debugfs: fix out-of-bounds read in spinorparamsshow Sashiko noticed an out-of-bounds read 1. In spinorparamsshow, the snorfnames array is passed to spinorprintflags using sizeofsnorfnames. Since snorfnames is an arr...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed an issue involving an untrusted unsigned subtraction operation. The following warnings from the “SMatch static checker” have also been fixed: net/rxrpc/rxgkapp.c:65 rxgkyfsdecodeticket Warning: Untrusted unsigned...

CVE-2026-43476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sps30i2c: fix buffer size in sps30i2creadmeas sizeofnum evaluates to sizeofsizet 8 bytes on 64-bit instead of the intended be32 element size 4 bytes. Use sizeofmeas to correctly match the buffer element type...

CLSA-2026-1776438517 gstreamer1-plugins-bad-free: Fix of CVE-2026-3082

CVE-2026-3082: fix heap-based buffer overflow in JPEG parser READBYTES macro by adding sizeofbuf bounds check...

CVE-2023-54312

In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix buffer overflow in tcpbasertt Using sizeofnv or strlennv+1 is correct...

CVE-2025-33132: Use of sizeof() on a Pointer Type

IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to...

SUSE CVE-2025-39962

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgkapp.c:65 rxgkyfsdecodeticket warn: untrusted unsigned subtract. 'ticketlen - 10 4' by prechecking the length of what we're tryi...

EUVD-2025-33336

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgkapp.c:65 rxgkyfsdecodeticket warn: untrusted unsigned subtract. 'ticketlen - 10 4' by prechecking the length of what we're tryi...

CVE-2025-39962

The CVE-2025-39962 entry concerns the Linux kernel RXRPC path. A bug in rxgk_app.c involved an untrusted unsigned subtract (ticket_len - 10 * 4) that could affect token parsing. The fix prechecks token lengths in two places and uses sizeof() for the extracted struct. This CVE is marked as resolve...

CVE-2025-39962 rxrpc: Fix untrusted unsigned subtract

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgkapp.c:65 rxgkyfsdecodeticket warn: untrusted unsigned subtract. 'ticketlen - 10 4' by prechecking the length of what we're tryi...

PT-2025-41376

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The Linux kernel contains a flaw related to an untrusted unsigned subtract operation within the rxrpc subsystem. Specifically, a Smatch static checker warning was identified in the rxgk...