CVE-2026-98169

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169

A vulnerability exists in the Linux kernel 's SMB client where the smb3_enum_snapshots() function fails to verify the actual length of a server's reply. Specifically, if snapshot_array_size is smaller than GMT_TOKEN_SIZE, the function sets ret_data_len to the size of struct smb_snapshot_array. Si...

EUVD-2026-93097

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-97941

A flaw was found in the Linux kernel. A race condition in the slab memory management subsystem occurs when memory is concurrently freed and refilled across multiple processor cores without proper locking. An unprivileged local user could exploit this flaw by issuing concurrent system calls that...

Linux Distros Unpatched Vulnerability : CVE-2026-90257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the...

DEBIAN-CVE-2026-90257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90257

CVE-2026-90257 affects the Linux kernel 's Bluetooth virtio_bt driver. The function virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and passes the response to bt_dev_info() and hci_set_fw_info() as an unbounded "%s" string starting at skb->data + 1, withou...

EUVD-2026-81850

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90221

CVE-2026-90221 affects the Linux kernel's NFC NCI (NFC Controller Interface) subsystem. The functions nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet without validating that the socket buffer (skb) contains sufficient data. A malformed response—injec...

PT-2026-94605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the Bluetooth virtio bt component. The virtbt setup zephyr function sends a Zephyr vendor command 0xfc08 to read build information and processes the...

DEBIAN-CVE-2026-90011

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

DEBIAN-CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

UBUNTU-CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89781

CVE-2026-89781 is an out-of-bounds read in the Linux kernel fs/ntfs3 driver, specifically in read_log_rec_buf() (fs/ntfs3/fslog.c). The function copies a log record using an offset derived from log->record_header_len, which is read verbatim from the on-disk restart area and only validated for ...

PT-2026-93387

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the read log rec buf function within the NTFS3 file system. The issue occurs because the log-record header len value is taken directly from the on-disk...

CVE-2026-90011: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...

SUSE CVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...