ipv6_frag_escape

IPV6FRAGESCAPE Una prueba de concepto fiable de escape de contenedor / jaula sin privilegios para CentOS / RHEL 10. Aprovecha un bug de fragmentación IPv6 ya corregido en ip6appenddata cerrado upstream por 38becddc, sin CVE, un desbordamiento lineal dentro de la slab hacia skbsharedinfo en la col...

Linux Distros Unpatched Vulnerability : CVE-2026-89614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of th...

Linux Distros Unpatched Vulnerability : CVE-2026-89652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname,...

Linux Distros Unpatched Vulnerability : CVE-2026-89471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports...

DEBIAN-CVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

AZL-100496 CVE-2026-89631 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

DEBIAN-CVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

UBUNTU-CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

UBUNTU-CVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

EUVD-2026-76634

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

CVE-2026-89656 libceph: reject buckets with mismatched CRUSH ids

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89656 libceph: reject buckets with mismatched CRUSH ids

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89614

CVE-2026-89614 affects the Linux kernel's NTFS file system driver . The flaw is in ntfs_cluster_alloc(), which bounds its free-cluster bitmap scan by the size of the on-disk $Bitmap rather than by the volume's actual cluster count (nr_clusters). Because these are independent quantities, a special...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

PT-2026-90372

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush decode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucke...

EUVD-2026-71438

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...