EUVD-2026-81919

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

CVE-2026-90058 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

CVE-2026-90058

CVE-2026-90058 is a Linux kernel vulnerability in the net/sched subsystem. The root cause is that qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through overhead, size-table data (u16), and size_log, allowing a crafted stab to set th...

CVE-2026-90053

CVE-2026-90053 is a vulnerability in the Linux kernel 's HTB qdisc (net/sched: sch_htb). The function htb_classify() follows filter-selected inner classes without bounding the traversal depth, so a self-referencing or cyclic inner-class u32 filter creates an infinite loop in the packet classifica...

CVE-2026-90053 net/sched: sch_htb: limit htb_classify inner-class filter hops

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

EUVD-2026-81914

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

CVE-2026-90053 net/sched: sch_htb: limit htb_classify inner-class filter hops

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration

A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENTCERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate...

Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration

A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENTCERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate...

Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration

A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENTCERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate...

Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration

A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENTCERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate...

WeaveMark

WeaveMark Implementación de referencia de Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading. WeaveMark incrusta un mensaje de k bits en texto generado por LLM manteniendo la distribución de tokens imparcial. Combina la dispersión de carga codificada κ bits de palabra de...

PT-2026-94423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq codel init function where the q-quantum and q-cparams.mtu values are set using psched mtu without proper clamping. When a device is configured with an excessive...

PT-2026-94422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow occurs in the fq pie init function when the default quantum is set using psched mtu without clamping. On devices with an exceptionally large Maximum Transmission Unit...

PT-2026-94420

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow issue exists in the Stochastic Fairness Queueing sfq scheduler. When sfq init sets the q-quantum value using psched mtu, a device with an excessively large Maximum...

CVE-2026-90058: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

CVE-2026-90076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

CVE-2026-90072: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return...

CVE-2026-90074: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: clamp default quantum to avoid signed overflow fqpieinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu retu...

PT-2026-94406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where the qdisc get stab function accepts a user-supplied size table. The qdisc calculate pkt len function can amplify the qdisc pkt len value...