CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

EUVD-2026-80458

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89852

In the Linux kernel 's qla2xxx SCSI driver, the mbx_cmd_t struct is allocated on the stack but left uninitialized. When qla2x00_mailbox_command() hits an early-return path (PCI permanent failure, device failed, EEH busy, ISP abort pending, mailbox access timeout, or purge mbox), it returns withou...

EUVD-2026-80452

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

EUVD-2026-80443

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

SUSE-SU-2026:23845-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme bsc1276223. - CVE-2026-17084: StringPrep algorithm considered...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

Security Bulletin: A vulnerability in OpenSSL affects IBM DevOps Code ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2025-11187 Vulnerability Details CVEID:CVE-2025-11187 DESCRIPTION: Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffe...

kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...

EUVD-2026-80041

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboottimerset.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory...

EUVD-2026-80033

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntoolstcpdumpstartset.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code...

EUVD-2026-80063

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wakeupset.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory...

Linux Distros Unpatched Vulnerability : CVE-2026-89843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t...