kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

DEBIAN-CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

UBUNTU-CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557

The SDL_image library, specifically versions through 3.4.8 and 2.8.12 , contains a stack out-of-bounds read vulnerability within the IMG_LoadLBM_IO() function in src/IMG_lbm.c. The root cause is the failure to validate the bitplane count when HAM mode is enabled. An attacker can provide a special...

CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

EUVD-2026-110835

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

PT-2026-126416

SDL image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG LoadLBM IO in src/IMG lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4895-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4895-1 advisory. - CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143079)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143079 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the out...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142750)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142750 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the out...

CLSA-2026-1787935638 kernel: Fix of 164 CVEs

wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds CVE-2023-53582 - net/sched: accept TCASTAB only for root qdisc CVE-2024-50039 - bpf, sockmap: Several fixes to bpfmsgpopdata CVE-2024-56720 - net: add more sanity checks to qdiscpktleninit CVE-2024-49948 -...

CVE-2026-90416

A flaw was found in the Linux kernel's RDMA/mlx5 component. The getparam function, used for debugging congestion parameters, incorrectly formats a 32-bit unsigned integer as a signed integer. This can lead to a stack out-of-bounds read when a large value is processed, potentially causing unexpect...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...