CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

UBUNTU-CVE-2026-98584

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98853

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...

UBUNTU-CVE-2026-98760

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

UBUNTU-CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

DEBIAN-CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

AZL-108924 CVE-2026-98466 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

UBUNTU-CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

Apache Camel information leakage vulnerability

Apache Camel versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises because the CXF component, when handling exceptions that are not declared by the SOAP consumer, returns exception messages and stac...

Qt resource management error vulnerability

Versions of Qt from 4.1.0 to 6.8.9 and from 6.9.0 to 6.11.2 contain a resource management vulnerability. This vulnerability stems from uncontrolled recursion in the SVG parser and renderer. Attackers can exploit this vulnerability by using specially crafted SVG files with deeply nested elements,...

openGauss-server Buffer Error Vulnerability

The openGauss-server versions 2.1.0, 3.0.0 to 3.0.6, 3.1.0, 5.0.0 to 5.0.5, 5.1.0, 6.0.0 to 6.0.6, 7.0.0-RC1, 7.0.0-RC2, and 7.0.0-RC3 have a buffer error vulnerability. This vulnerability arises from the HllObjectUnpack unpacking function, which does not verify the relationship between lenTotal...

rdesktop buffer error vulnerability

rdesktop versions 1.9.0 and earlier have a buffer error vulnerability. This vulnerability stems from a stack overflow issue in the processplane function in bitmap.c. A malicious RDP server can exploit this vulnerability by sending malformed 32-bit compressed bitmaps. These bitmaps claim a larger...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the Knative HTTP consumer, during processing failures, returns exception messages containing class names, messages, and stack traces...

Zephyr buffer error vulnerability

Zephyr versions 3.3.0 to 4.4.2 have a buffer error vulnerability. This vulnerability stems from the Reply function cpdecoderesponse in the OSDP control panel, which does not check the upper limit of the payload length for REPLYKEYPPAD and REPLYRAW responses. As a result, when memcopy is used to...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator 2.0.29 and earlier versions of 2.0.x, 3.2.29 and earlier versions of 3.2.x, versions before 3.4.0 of 3.3.x, 3.4.1, 3.5.0, 3.5.1 to 3.5.3, 3.6.4 and earlier versions of 3.6.x, 3.7.2 and earlier versions of 3.7.x, 3.8.0 to 3.8.1, 3.9.0 to 3.9.2, and 4.0.0 to 4.0.4 have a buffer erro...

Pillow improper exception handling vulnerabilities

Pillow versions from 9.1.0 to 13.0.0 have a vulnerability related to improper exception handling. This vulnerability arises when the ImagingPaletteCacheUpdate function is used with an air-conditioned palette, and the local cache array is not initialized. As a result, the conversion path uses...

nkoriyama aribb24 Buffer Error Vulnerability

nkoriyama aribb24 versions 1.0.3 and earlier have a buffer overflow vulnerability. This vulnerability stems from the decoderhandlecsi function in src/decoder.c, where there is a stack buffer overflow. Attackers can exploit this by providing unlimited CSI parameter files, causing FFmpeg or VLC to...

CVE-2026-98853

The Linux kernel contains a vulnerability where IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. Because encap_level tracks header bytes instead of callback depth, a deep chain can cause kernel stack exhaustion . To resolve this, the kernel now counts ...