CVE-2026-68516

OpenEXR (the reference implementation for the EXR image format) versions 3.4.0 through 3.4.13 are vulnerable to a denial of service via a crafted HTJ2K-compressed EXR file. A malicious file whose JPEG 2000 SIZ fields place the first tile outside the visible image reaches invalid tile and codebloc...

CVE-2026-74669

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

CVE-2026-74669

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

CVE-2026-74669 ipvs: clear IPv4 options after rebasing tunnel ICMP errors

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

EUVD-2026-64356

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

CVE-2026-74669 ipvs: clear IPv4 options after rebasing tunnel ICMP errors

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

PT-2026-79674

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip vs in icmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp send. However, IPCBskb-opt still describes the outer IPv4...

Linux Distros Unpatched Vulnerability : CVE-2026-74669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it...

PT-2026-76710

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on cmd socknotifyev drivers/modem/vendor standalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via net buf linearize, which caps the copy at 39 bytes and returns out len = 39. The two...

Linux Distros Unpatched Vulnerability : CVE-2026-68420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Comm...

CVE-2026-68184

A flaw was found in the Linux kernel's CD-ROM cdrom driver. When handling the CDROMVOLCTRL command, the mmcioctlcdromvolume function can perform an incorrect calculation of buffer length after a pointer adjustment. This leads to a stack out-of-bounds read, where 8 bytes of data beyond the intende...

CVE-2026-68420

A flaw was found in the Linux kernel's xfrm component. A local user could trigger a stack-out-of-bounds read by configuring an outbound Internet Protocol Security IPsec policy with optional IPsec Flow Template Specification IPTFS templates. This vulnerability can lead to a system crash, resulting...

CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

UBUNTU-CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

UBUNTU-CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

CVE-2026-68420 xfrm: reject optional IPTFS templates in outbound policies

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

CVE-2026-68184

The CVE-2026-68184 issue affects the Linux kernel CD-ROM code, specifically mmc_ioctl_cdrom_volume for CDROMVOLCTRL. A 32-byte stack buffer is used to read the audio control mode page (buflen 24, then extended if a block descriptor is present). The function later builds a MODE SELECT payload by m...

CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

EUVD-2026-55545

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...